CVE-2018-9156 - CVE House
Back to Database
Status published High CVE-2018-9156

An issue was discovered on AXIS P1354 (IP camera) Firmware...

Vulnerability Description

An issue was discovered on AXIS P1354 (IP camera) Firmware version 5.90.1.1 devices. The upload web page doesn't verify the file type, and an attacker can upload a webshell by making a fileUpload.shtml request for a custom .shtml file, which is interpreted by the Apache HTTP Server mod_include module with "<!--#exec cmd=" support. The file needs to include a specific string to meet the internal system architecture. After the webshell upload, an attacker can use the webshell to perform remote code execution such as running a system command (ls, ping, cat /etc/passwd, etc.). NOTE: the vendor reportedly indicates that this is an intended feature or functionality

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2018-9156

Credits & Attribution

No credits recorded in the NVD database.

References

More from axis

View All →
CVE-2018-9158
An issue was discovered on AXIS M1033-W (IP camera) Firmware...
High 7.5
CVE-2018-9157
An issue was discovered on AXIS M1033-W (IP camera) Firmware...
High 7.5
CVE-2018-10664
An issue was discovered in the httpd process in multiple...
High 7.5
CVE-2018-10663
An issue was discovered in multiple models of Axis IP...
High 7.5
CVE-2018-10662
An issue was discovered in multiple models of Axis IP...
Critical 9.8

Affected Vendor

Affected Software

p1354 firmware
Vulnerable Versions:
5.90.1.1

Timeline

Official Publish: April 1st, 2018
Last Modified: August 5th, 2024
Added to House: July 20th, 2026

CVSS Vectors

V3: CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.