CVE:CVE-2004-2426
CNNVD:CNNVD-200412-745
Axis Network Camera 2.40及其以前的版本和Video Server 3.12以前的版本存在目录遍历漏洞。远程攻击者借助ServerManager.srv的HTTP POST请求中的..(点 点）绕过认证，然后使用这些权限来进行其他活动，如使用editcgi.cgi修改文件。
solution:Upgrade axis 2100_network_camera to a higher version than 2.12,2.30,2.31,2.32,2.33,2.34,2.40,2.41,and avoid the version 2.12,2.30,2.31,2.32,2.33,2.34,2.40,2.41; Upgrade axis 2110_network_camera to a higher version than 2.12,2.30,2.31,2.32,2.34,2.40,2.41,and avoid the version 2.12,2.30,2.31,2.32,2.34,2.40,2.41; Upgrade axis 2120_network_camera to a higher version than 2.12,2.30,2.31,2.32,2.34,2.40,2.41,and avoid the version 2.12,2.30,2.31,2.32,2.34,2.40,2.41; Upgrade axis 2130_ptz_network_camera to a higher version than 2.30,2.31,2.32,2.34,2.40,and avoid the version 2.30,2.31,2.32,2.34,2.40; Upgrade axis 230_mpeg2_video_server to a higher version than 3.11,and avoid the version 3.11; Upgrade axis 2400_video_server to a higher version than 1.1,1.2,1.10,1.11,1.12,1.15,2.0,2.20,2.30,2.31,2.32,2.33,2.34,3.11,3.12,and avoid the version 1.1,1.2,1.10,1.11,1.12,1.15,2.0,2.20,2.30,2.31,2.32,2.33,2.34,3.11,3.12; Upgrade axis 2401_video_server to a higher version than 1.0_1,1.15,2.20,2.30,2.31,2.32,2.33,2.34,3.12,3.13,and avoid the version 1.0_1,1.15,2.20,2.30,2.31,2.32,2.33,2.34,3.12,3.13; Upgrade axis 2411_video_server to a higher version than 3.12,3.13,and avoid the version 3.12,3.13; Upgrade axis 2420_network_camera to a higher version than 2.12,2.30,2.31,2.32,2.33,2.34,2.40,2.41,and avoid the version 2.12,2.30,2.31,2.32,2.33,2.34,2.40,2.41; Upgrade axis 2420_video_server to a higher version than 2.32,2.34,and avoid the version 2.32,2.34; Upgrade axis 2460_network_dvr to a higher version than *,3.10,3.11,and avoid the version 3.10,3.11; Upgrade axis 2490_serial_server to a higher version than *,2.11.3,and avoid the version 2.11.3; Upgrade axis 250s_video_server to a higher version than *,3.03,3.10,and avoid the version 3.03,3.10; Upgrade axis storpoint_cd to a higher version than *