AXIS IP Utility before 4.18.0 allows for remote code execution and local privilege escalation by the means of DLL hijacking. IPUtility.exe would attempt to load DLLs from its current working directory which could allow for remote code execution if a compromised DLL would be placed in the same folder.
References
| Link | Resource |
|---|---|
| https://www.axis.com/files/tech_notes/CVE-2022-23410.pdf | Vendor Advisory |
Configurations
History
10 Mar 2022, 17:45
| Type | Values Removed | Values Added |
|---|---|---|
| Summary | AXIS IP Utility before 4.18.0 allows for remote code execution and local privilege escalation by the means of DLL hijacking. IPUtility.exe would attempt to load DLLs from its current working directory which could allow for remote code execution if a compromised DLL would be placed in the same folder. |
23 Feb 2022, 18:13
| Type | Values Removed | Values Added |
|---|---|---|
| References | (MISC) https://www.axis.com/files/tech_notes/CVE-2022-23410.pdf - Vendor Advisory | |
| First Time |
Axis
Axis ip Utility |
|
| CPE | cpe:2.3:a:axis:ip_utility:*:*:*:*:*:*:*:* | |
| CWE | CWE-427 | |
| CVSS |
v2 : v3 : |
v2 : 4.4
v3 : 7.8 |
14 Feb 2022, 22:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2022-02-14 22:15
Updated : 2023-12-10 14:22
NVD link : CVE-2022-23410
Mitre link : CVE-2022-23410
CVE.ORG link : CVE-2022-23410
JSON object : View
Products Affected
axis
- ip_utility
CWE
CWE-427
Uncontrolled Search Path Element