CVE-2004-2425: Axis Network Camera 2.40 and earlier, and Video Server 3.12 and earlier, allows remote attackers to execute...

Security readout for executives and security teams

This is a remote command execution flaw in older Axis network cameras and video servers. If a vulnerable device exposes the affected CGI endpoint, an attacker could run commands on the device. The public bundle does not provide CVSS, confirmed active exploitation, or a named fix. Exposure is most likely on legacy Axis camera or video server appliances still running the listed firmware versions, especially where the web interface or virtualinput.cgi is reachable from untrusted networks. Prioritize externally reachable or business-critical camera infrastructure. The flaw can permit device-level command execution, but available sources are old and incomplete, so remediation should start with exposure discovery and vendor-supported lifecycle decisions. Mitigation focus: Inventory Axis cameras and video servers for affected firmware versions.; Remove affected device management interfaces from internet exposure.; Restrict access to trusted management networks only..

Prepared

Jun 29, 2026, 18:28 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.