CVE-2018-10660

CRITICAL

Axis IP Cameras - OS Command Injection

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 2 public exploits for CVE-2018-10660. PoCs published by Metasploit, Or Peles, wvu, sinn3r, Brent Cook, Jacob Robles, Matthew Kienow, Shelby Pace, Chris Lee, Cale Black, including Metasploit module exploits/linux/http/axis_srv_parhand_rce.

AI-analyzed exploit summary This Metasploit module exploits an authentication bypass and command injection vulnerability in Axis Network Cameras to achieve remote code execution as root. It leverages the .srv functionality and the parhand service via D-Bus commands.

Description

An issue was discovered in multiple models of Axis IP Cameras. There is Shell Command Injection.

Exploits (2)

exploitdb WORKING POC VERIFIED
by Metasploit · rubyremotelinux
https://www.exploit-db.com/exploits/45100

This Metasploit module exploits an authentication bypass and command injection vulnerability in Axis Network Cameras to achieve remote code execution as root. It leverages the .srv functionality and the parhand service via D-Bus commands.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: Axis Network Camera (multiple models, see references)
No auth needed
Prerequisites: Network access to the target camera · D-Bus service accessible
devstral-2 · analyzed Feb 16, 2026 Full analysis →
metasploit WORKING POC EXCELLENT
by Or Peles, wvu, sinn3r, Brent Cook, Jacob Robles, Matthew Kienow, Shelby Pace, Chris Lee, Cale Black · rubypocunix
https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/axis_srv_parhand_rce.rb

This Metasploit module exploits an authentication bypass in Axis Network Camera's .srv functionality and a command injection in parhand to achieve remote code execution as root. It leverages D-Bus communication to inject and execute arbitrary commands.

Classification
Working Poc 100%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: Axis Network Camera (multiple models)
No auth needed
Prerequisites: Network access to the target device · D-Bus service accessible on the target
devstral-2 · analyzed Feb 19, 2026 Full analysis →

References (4)

Core 4
Core References
Exploit, Third Party Advisory, VDB Entry exploit x_refsource_exploit-db
https://www.exploit-db.com/exploits/45100/
Vendor Advisory x_refsource_confirm
https://www.axis.com/files/faq/Advisory_ACV-128401.pdf

Scores

CVSS v3 9.8
EPSS 0.9133
EPSS Percentile 99.7%
Attack Vector NETWORK
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Details

CWE
CWE-78
Status published
Products (50)
axis/a1001_firmware < 1.65.1
axis/a8004-v_firmware < 1.65.2
axis/a8105-e_firmware < 1.65.2
axis/a9161_firmware < 1.65.0
axis/a9188-v_firmware < 1.65.0
axis/a9188_firmware < 1.65.0
axis/c1004-e_firmware < 1.81.040.1
axis/c2005_firmware < 1.81.040.1
axis/c3003-e_firmware < 1.81.040.1
axis/c8033_firmware < 1.81.040.1
... and 40 more
Published Jun 26, 2018
Tracked Since Feb 18, 2026