Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.3

AXIS 2100 camera permits admin actions via forged web requests

CVE-2007-5213 · published 19 years ago
Summary

The AXIS 2100 network camera's web interface can be tricked into performing administrator tasks, such as changing the email server or the device hostname, without proper authentication. This could let a remote attacker alter the camera's configuration. Update the camera to the latest firmware and limit web access to trusted users or networks.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
axis 2100_network_camera 2.02
cpe:2.3:h:axis:2100_network_camera:2.02:*:*:*:*:*:*:*
axis 2100_network_camera_firmware <= 2.42
cpe:2.3:h:axis:2100_network_camera_firmware:*:*:*:*:*:*:*:*
Original advisory text
Multiple cross-site request forgery (CSRF) vulnerabilities in the AXIS 2100 Network Camera 2.02 with firmware 2.43 and earlier allow remote attackers to perform actions as administrators, as demons...
Multiple cross-site request forgery (CSRF) vulnerabilities in the AXIS 2100 Network Camera 2.02 with firmware 2.43 and earlier allow remote attackers to perform actions as administrators, as demonstrated by (1) an SMTP server change through the conf_SMTP_MailServer1 parameter to ServerManager.srv and (2) a hostname change through the conf_Network_HostName parameter on the Network page.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit (estimated)
  • Gives an attacker full control (estimated)
Severity
9.3 Critical
Exploitation
2% chance of attack within 30 days
Type
CWE-352Cross-Site Request Forgery (CSRF)
Timeline
Published4 Oct 2007
Updated3 Nov 2026
First seen29 Sep 2026
Sources
CVE-2007-5213 · NVD
Track software like this
Free during beta