CVE-2018-10662

CRITICAL IN THE WILD

Axis IP Cameras - Exposed Insecure Interface

Title source: llm
STIX 2.1

Exploitation Summary

CVE-2018-10662 has been observed exploited in the wild (reported by InTheWild.io). EIP tracks 2 public exploits from researchers including Metasploit, Or Peles, wvu, sinn3r, Brent Cook, Jacob Robles, Matthew Kienow, Shelby Pace, Chris Lee, Cale Black, including a Metasploit module exploits/linux/http/axis_srv_parhand_rce.

AI-analyzed exploit summary This Metasploit module exploits an authentication bypass and command injection vulnerability in Axis Network Cameras to achieve remote code execution as root. It leverages the .srv functionality and the parhand service via D-Bus commands.

Description

An issue was discovered in multiple models of Axis IP Cameras. There is an Exposed Insecure Interface.

Exploits (2)

exploitdb WORKING POC VERIFIED
by Metasploit · rubyremotelinux
https://www.exploit-db.com/exploits/45100

This Metasploit module exploits an authentication bypass and command injection vulnerability in Axis Network Cameras to achieve remote code execution as root. It leverages the .srv functionality and the parhand service via D-Bus commands.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: Axis Network Camera (multiple models, see references)
No auth needed
Prerequisites: Network access to the target camera · D-Bus service accessible
devstral-2 · analyzed Feb 16, 2026 Full analysis →
metasploit WORKING POC EXCELLENT
by Or Peles, wvu, sinn3r, Brent Cook, Jacob Robles, Matthew Kienow, Shelby Pace, Chris Lee, Cale Black · rubypocunix
https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/axis_srv_parhand_rce.rb

This Metasploit module exploits an authentication bypass in Axis Network Camera's .srv functionality and a command injection in parhand to achieve remote code execution as root. It leverages D-Bus communication to inject and execute arbitrary commands.

Classification
Working Poc 100%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: Axis Network Camera (multiple models)
No auth needed
Prerequisites: Network access to the target camera · D-Bus service accessible
devstral-2 · analyzed Apr 22, 2026 Full analysis →

References (4)

Core 4
Core References
Exploit, Third Party Advisory, VDB Entry exploit x_refsource_exploit-db
https://www.exploit-db.com/exploits/45100/
Vendor Advisory x_refsource_confirm
https://www.axis.com/files/faq/Advisory_ACV-128401.pdf

Scores

CVSS v3 9.8
EPSS 0.8698
EPSS Percentile 99.5%
Attack Vector NETWORK
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Details

InTheWild.io 2023-05-11
Status published
Products (50)
axis/a1001_firmware < 1.65.1
axis/a8004-v_firmware < 1.65.2
axis/a8105-e_firmware < 1.65.2
axis/a9161_firmware < 1.65.0
axis/a9188-v_firmware < 1.65.0
axis/a9188_firmware < 1.65.0
axis/c1004-e_firmware < 1.81.040.1
axis/c2005_firmware < 1.81.040.1
axis/c3003-e_firmware < 1.81.040.1
axis/c8033_firmware < 1.81.040.1
... and 40 more
Published Jun 26, 2018
Tracked Since Feb 18, 2026