CVE-2004-2426: Axis 2100 Network Camera

Medium severity, CVSS 5.0. EPSS: 4.2% chance of exploitation in the next 30 days.

Directory traversal vulnerability in Axis Network Camera 2.40 and earlier, and Video Server 3.12 and earlier, allows remote attackers to bypass authentication via a .. (dot dot) in an HTTP POST request to ServerManager.srv, then use these privileges to conduct other activities, such as modifying files using editcgi.cgi.

Affected products

• Axis 2100 Network Camera: version 2.12 only; version 2.30 only; version 2.31 only; version 2.32 only; version 2.33 only; version 2.34 only; …
• Axis 2110 Network Camera: version 2.12 only; version 2.30 only; version 2.31 only; version 2.32 only; version 2.34 only; version 2.40 only; …
• Axis 2120 Network Camera: version 2.12 only; version 2.30 only; version 2.31 only; version 2.32 only; version 2.34 only; version 2.40 only; …
• Axis 2130 Ptz Network Camera: version 2.30 only; version 2.31 only; version 2.32 only; version 2.34 only; version 2.40 only
• Axis 230 MPEG2 Video Server: version 3.11 only
• Axis 2400 Video Server: version 1.1 only; version 1.2 only; version 1.10 only; version 1.11 only; version 1.12 only; version 1.15 only; …
• Axis 2401 Video Server: version 1.0_1 only; version 1.15 only; version 2.20 only; version 2.30 only; version 2.31 only; version 2.32 only; …
• Axis 2411 Video Server: version 3.12 only; version 3.13 only
• Axis 2420 Network Camera: version 2.12 only; version 2.30 only; version 2.31 only; version 2.32 only; version 2.33 only; version 2.34 only; …
• Axis 2420 Video Server: version 2.32 only; version 2.34 only
• Axis 2460 Network Dvr: any version; version 3.10 only; version 3.11 only
• Axis 2490 Serial Server: any version; version 2.11.3 only
• Axis 250s Video Server: any version; version 3.03 only; version 3.10 only
• Axis Storpoint Cd: any version

Published 2004-12-31. Last modified 2026-06-16.