Read the docs
TI-2004-02296 Aliases CVE-2004-2426GHSA-qhmj-pfxw-7rwc

Directory traversal vulnerability in Axis Network Camera 2.40 and earlier, and Video…

Priority LOW 30Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
— Not recorded in CVSS 2.0
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · Partial · None
Fix status
No fix listed

Attack profile from CVSS 2.0 · NVD. Fix status from CNA.

Summary

Directory traversal vulnerability in Axis Network Camera 2.40 and earlier, and Video Server 3.12 and earlier, allows remote attackers to bypass authentication via a .. (dot dot) in an HTTP POST request to ServerManager.srv, then use these privileges to conduct other activities, such as modifying files using editcgi.cgi.

Why it matters now

EPSS 0.04187 90th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 74

CPEVersionsRoleVendor
cpe:2.3:h:axis:2100_network_camera:2.12:*:*:*:*:*:*:*2.12VulnerableAxis Communications AB
cpe:2.3:h:axis:2100_network_camera:2.30:*:*:*:*:*:*:*2.30VulnerableAxis Communications AB
cpe:2.3:h:axis:2100_network_camera:2.31:*:*:*:*:*:*:*2.31VulnerableAxis Communications AB
cpe:2.3:h:axis:2100_network_camera:2.32:*:*:*:*:*:*:*2.32VulnerableAxis Communications AB
cpe:2.3:h:axis:2100_network_camera:2.33:*:*:*:*:*:*:*2.33VulnerableAxis Communications AB
cpe:2.3:h:axis:2100_network_camera:2.34:*:*:*:*:*:*:*2.34VulnerableAxis Communications AB
cpe:2.3:h:axis:2100_network_camera:2.40:*:*:*:*:*:*:*2.40VulnerableAxis Communications AB
cpe:2.3:h:axis:2100_network_camera:2.41:*:*:*:*:*:*:*2.41VulnerableAxis Communications AB
cpe:2.3:h:axis:2110_network_camera:2.12:*:*:*:*:*:*:*2.12VulnerableAxis Communications AB
cpe:2.3:h:axis:2110_network_camera:2.30:*:*:*:*:*:*:*2.30VulnerableAxis Communications AB
Show 64 more CPE
CPEVersionsRoleVendor
cpe:2.3:h:axis:2110_network_camera:2.31:*:*:*:*:*:*:*2.31VulnerableAxis Communications AB
cpe:2.3:h:axis:2110_network_camera:2.32:*:*:*:*:*:*:*2.32VulnerableAxis Communications AB
cpe:2.3:h:axis:2110_network_camera:2.34:*:*:*:*:*:*:*2.34VulnerableAxis Communications AB
cpe:2.3:h:axis:2110_network_camera:2.40:*:*:*:*:*:*:*2.40VulnerableAxis Communications AB
cpe:2.3:h:axis:2110_network_camera:2.41:*:*:*:*:*:*:*2.41VulnerableAxis Communications AB
cpe:2.3:h:axis:2120_network_camera:2.12:*:*:*:*:*:*:*2.12VulnerableAxis Communications AB
cpe:2.3:h:axis:2120_network_camera:2.30:*:*:*:*:*:*:*2.30VulnerableAxis Communications AB
cpe:2.3:h:axis:2120_network_camera:2.31:*:*:*:*:*:*:*2.31VulnerableAxis Communications AB
cpe:2.3:h:axis:2120_network_camera:2.32:*:*:*:*:*:*:*2.32VulnerableAxis Communications AB
cpe:2.3:h:axis:2120_network_camera:2.34:*:*:*:*:*:*:*2.34VulnerableAxis Communications AB
cpe:2.3:h:axis:2120_network_camera:2.40:*:*:*:*:*:*:*2.40VulnerableAxis Communications AB
cpe:2.3:h:axis:2120_network_camera:2.41:*:*:*:*:*:*:*2.41VulnerableAxis Communications AB
cpe:2.3:h:axis:2130_ptz_network_camera:2.30:*:*:*:*:*:*:*2.30VulnerableAxis Communications AB
cpe:2.3:h:axis:2130_ptz_network_camera:2.31:*:*:*:*:*:*:*2.31VulnerableAxis Communications AB
cpe:2.3:h:axis:2130_ptz_network_camera:2.32:*:*:*:*:*:*:*2.32VulnerableAxis Communications AB
cpe:2.3:h:axis:2130_ptz_network_camera:2.34:*:*:*:*:*:*:*2.34VulnerableAxis Communications AB
cpe:2.3:h:axis:2130_ptz_network_camera:2.40:*:*:*:*:*:*:*2.40VulnerableAxis Communications AB
cpe:2.3:h:axis:230_mpeg2_video_server:3.11:*:*:*:*:*:*:*3.11VulnerableAxis Communications AB
cpe:2.3:h:axis:2400_video_server:1.1:*:*:*:*:*:*:*1.1VulnerableAxis Communications AB
cpe:2.3:h:axis:2400_video_server:1.2:*:*:*:*:*:*:*1.2VulnerableAxis Communications AB
cpe:2.3:h:axis:2400_video_server:1.10:*:*:*:*:*:*:*1.10VulnerableAxis Communications AB
cpe:2.3:h:axis:2400_video_server:1.11:*:*:*:*:*:*:*1.11VulnerableAxis Communications AB
cpe:2.3:h:axis:2400_video_server:1.12:*:*:*:*:*:*:*1.12VulnerableAxis Communications AB
cpe:2.3:h:axis:2400_video_server:1.15:*:*:*:*:*:*:*1.15VulnerableAxis Communications AB
cpe:2.3:h:axis:2400_video_server:2.0:*:*:*:*:*:*:*2.0VulnerableAxis Communications AB
cpe:2.3:h:axis:2400_video_server:2.20:*:*:*:*:*:*:*2.20VulnerableAxis Communications AB
cpe:2.3:h:axis:2400_video_server:2.30:*:*:*:*:*:*:*2.30VulnerableAxis Communications AB
cpe:2.3:h:axis:2400_video_server:2.31:*:*:*:*:*:*:*2.31VulnerableAxis Communications AB
cpe:2.3:h:axis:2400_video_server:2.32:*:*:*:*:*:*:*2.32VulnerableAxis Communications AB
cpe:2.3:h:axis:2400_video_server:2.33:*:*:*:*:*:*:*2.33VulnerableAxis Communications AB
cpe:2.3:h:axis:2400_video_server:2.34:*:*:*:*:*:*:*2.34VulnerableAxis Communications AB
cpe:2.3:h:axis:2400_video_server:3.11:*:*:*:*:*:*:*3.11VulnerableAxis Communications AB
cpe:2.3:h:axis:2400_video_server:3.12:*:*:*:*:*:*:*3.12VulnerableAxis Communications AB
cpe:2.3:h:axis:2401_video_server:1.0_1:*:*:*:*:*:*:*1.0_1VulnerableAxis Communications AB
cpe:2.3:h:axis:2401_video_server:1.15:*:*:*:*:*:*:*1.15VulnerableAxis Communications AB
cpe:2.3:h:axis:2401_video_server:2.20:*:*:*:*:*:*:*2.20VulnerableAxis Communications AB
cpe:2.3:h:axis:2401_video_server:2.30:*:*:*:*:*:*:*2.30VulnerableAxis Communications AB
cpe:2.3:h:axis:2401_video_server:2.31:*:*:*:*:*:*:*2.31VulnerableAxis Communications AB
cpe:2.3:h:axis:2401_video_server:2.32:*:*:*:*:*:*:*2.32VulnerableAxis Communications AB
cpe:2.3:h:axis:2401_video_server:2.33:*:*:*:*:*:*:*2.33VulnerableAxis Communications AB
cpe:2.3:h:axis:2401_video_server:2.34:*:*:*:*:*:*:*2.34VulnerableAxis Communications AB
cpe:2.3:h:axis:2401_video_server:3.12:*:*:*:*:*:*:*3.12VulnerableAxis Communications AB
cpe:2.3:h:axis:2401_video_server:3.13:*:*:*:*:*:*:*3.13VulnerableAxis Communications AB
cpe:2.3:h:axis:2411_video_server:3.12:*:*:*:*:*:*:*3.12VulnerableAxis Communications AB
cpe:2.3:h:axis:2411_video_server:3.13:*:*:*:*:*:*:*3.13VulnerableAxis Communications AB
cpe:2.3:h:axis:2420_network_camera:2.12:*:*:*:*:*:*:*2.12VulnerableAxis Communications AB
cpe:2.3:h:axis:2420_network_camera:2.30:*:*:*:*:*:*:*2.30VulnerableAxis Communications AB
cpe:2.3:h:axis:2420_network_camera:2.31:*:*:*:*:*:*:*2.31VulnerableAxis Communications AB
cpe:2.3:h:axis:2420_network_camera:2.32:*:*:*:*:*:*:*2.32VulnerableAxis Communications AB
cpe:2.3:h:axis:2420_network_camera:2.33:*:*:*:*:*:*:*2.33VulnerableAxis Communications AB
cpe:2.3:h:axis:2420_network_camera:2.34:*:*:*:*:*:*:*2.34VulnerableAxis Communications AB
cpe:2.3:h:axis:2420_network_camera:2.40:*:*:*:*:*:*:*2.40VulnerableAxis Communications AB
cpe:2.3:h:axis:2420_network_camera:2.41:*:*:*:*:*:*:*2.41VulnerableAxis Communications AB
cpe:2.3:h:axis:2420_video_server:2.32:*:*:*:*:*:*:*2.32VulnerableAxis Communications AB
cpe:2.3:h:axis:2420_video_server:2.34:*:*:*:*:*:*:*2.34VulnerableAxis Communications AB
cpe:2.3:h:axis:2460_network_dvr:*:*:*:*:*:*:*:*all versionsVulnerableAxis Communications AB
cpe:2.3:h:axis:2460_network_dvr:3.10:*:*:*:*:*:*:*3.10VulnerableAxis Communications AB
cpe:2.3:h:axis:2460_network_dvr:3.11:*:*:*:*:*:*:*3.11VulnerableAxis Communications AB
cpe:2.3:h:axis:2490_serial_server:*:*:*:*:*:*:*:*all versionsVulnerableAxis Communications AB
cpe:2.3:h:axis:2490_serial_server:2.11.3:*:*:*:*:*:*:*2.11.3VulnerableAxis Communications AB
cpe:2.3:h:axis:250s_video_server:*:*:*:*:*:*:*:*all versionsVulnerableAxis Communications AB
cpe:2.3:h:axis:250s_video_server:3.03:*:*:*:*:*:*:*3.03VulnerableAxis Communications AB
cpe:2.3:h:axis:250s_video_server:3.10:*:*:*:*:*:*:*3.10VulnerableAxis Communications AB
cpe:2.3:h:axis:storpoint_cd:*:*:*:*:*:*:*:*all versionsVulnerableAxis Communications AB

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2004-2426
  2. 2026-10-03 Alias added: GHSA-qhmj-pfxw-7rwc

References

Exploit 1

Patch 1

Other 1

  • TI-2003-00222 The web-based administration capability for various Axis Network Camera products allows… CVSS 2.0HIGH 10.0
  • TI-2007-02157 Stack-based buffer overflow in the SaveBMP method in the AXIS Camera Control (aka… CVSS 2.0HIGH 9.3
  • TI-2004-02297 Axis Network Camera 2.40 and earlier, and Video Server 3.12 and earlier, allows remote… CVSS 2.0HIGH 10.0
  • TI-2004-02295 Axis Network Camera 2.40 and earlier, and Video Server 3.12 and earlier, allows remote… CVSS 2.0HIGH 7.5
  • TI-2007-05018 Multiple cross-site request forgery (CSRF) vulnerabilities in the AXIS 2100 Network… CVSS 2.0HIGH 9.3
  • TI-2001-01491 Axis network camera 2120, 2110, 2100, 200+ and 200 contains a default administration… CVSS 2.0HIGH 7.5
See all 9 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences