CVE-2004-2425: Axis 2100 Network Camera

High severity, CVSS 7.5. EPSS: 13.5% chance of exploitation in the next 30 days.

Axis Network Camera 2.40 and earlier, and Video Server 3.12 and earlier, allows remote attackers to execute arbitrary commands via accent (`) and possibly other shell metacharacters in the query string to virtualinput.cgi.

Affected products

• Axis 2100 Network Camera: version 2.12 only; version 2.30 only; version 2.31 only; version 2.32 only; version 2.33 only; version 2.34 only; …
• Axis 2110 Network Camera: version 2.12 only; version 2.30 only; version 2.31 only; version 2.32 only; version 2.34 only; version 2.40 only; …
• Axis 2120 Network Camera: version 2.12 only; version 2.30 only; version 2.31 only; version 2.32 only; version 2.34 only; version 2.40 only; …
• Axis 2130 Ptz Network Camera: version 2.30 only; version 2.31 only; version 2.32 only; version 2.34 only; version 2.40 only
• Axis 230 MPEG2 Video Server: version 3.11 only
• Axis 2400 Video Server: version 1.1 only; version 1.2 only; version 1.10 only; version 1.11 only; version 1.12 only; version 1.15 only; …
• Axis 2401 Video Server: version 1.0_1 only; version 1.15 only; version 2.20 only; version 2.30 only; version 2.31 only; version 2.32 only; …
• Axis 2411 Video Server: version 3.12 only; version 3.13 only
• Axis 2420 Network Camera: version 2.12 only; version 2.30 only; version 2.31 only; version 2.32 only; version 2.33 only; version 2.34 only; …
• Axis 2420 Video Server: version 2.32 only; version 2.34 only
• Axis 2460 Network Dvr: any version; version 3.10 only; version 3.11 only
• Axis 2490 Serial Server: any version; version 2.11.3 only
• Axis 250s Video Server: any version; version 3.03 only; version 3.10 only
• Axis Storpoint Cd: any version

Published 2004-12-31. Last modified 2026-06-16.