LiveActive security incident?Get immediate response
CVE Record

CVE-2018-9156: An issue was discovered on AXIS P1354 (IP camera) Firmware version 5.90.1.1 devices.

An issue was discovered on AXIS P1354 (IP camera) Firmware version 5.90.1.1 devices. The upload web page doesn't verify the file type, and an attacker can upload a webshell by making a fileUpload.shtml request for a custom .shtml file, which is interpreted by the Apache HTTP Server mod_include module with "<!--#exec cmd=" support. The file needs to include a specific string to meet the internal system architecture. After the webshell upload, an attacker can use the webshell to perform remote code execution such as running a system command (ls, ping, cat /etc/passwd, etc.). NOTE: the vendor reportedly indicates that this is an intended feature or functionality

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysishigh

Security readout for executives and security teams

Plain-English summary

This CVE describes a way to upload a server-interpreted file to an AXIS P1354 IP camera running firmware 5.90.1.1, potentially allowing remote command execution. The public record also notes the vendor reportedly considered this intended functionality, so treat affected exposure as configuration- and deployment-dependent until validated.

Executive priority

Prioritize any internet-facing or shared-network AXIS P1354 cameras for validation. The business concern is remote control of a camera appliance, but urgency depends on whether the upload interface is reachable and whether vendor-supported mitigations exist.

Technical view

The issue involves insufficient file-type validation in the camera upload web page. A crafted server-side include file can be interpreted by Apache mod_include and execute commands. The source bundle does not establish authentication requirements, CVSS score, patch status, or affected firmware beyond AXIS P1354 5.90.1.1.

Likely exposure

Exposure appears limited to AXIS P1354 IP cameras on firmware 5.90.1.1 with the relevant upload functionality reachable. Internet-facing or broadly reachable management interfaces would materially increase risk. The sources do not identify broader AXIS product impact.

Exploitation context

The CVE record describes remote code execution after a malicious upload, but CISA KEV is false and the bundle provides no evidence of active exploitation. Public technical detail exists, but weaponization status and authentication prerequisites are not established in the provided sources.

Researcher notes

Evidence is sparse and partly disputed by the vendor-functionality note. Do not assume unauthenticated access, broader model impact, or a vendor patch from the provided bundle. Focus research on confirming prerequisites, reachable attack surface, firmware state, and supported Axis guidance.

Mitigation direction

  • Inventory AXIS P1354 cameras and confirm firmware version 5.90.1.1 exposure.
  • Restrict camera management and upload interfaces to trusted administrative networks.
  • Check current Axis vendor guidance for supported configuration or firmware direction.
  • Review whether server-side include execution is required in the deployment.
  • Monitor camera logs for unexpected uploads or command execution indicators.

Validation and detection

  • Identify reachable AXIS P1354 management interfaces from internal and external networks.
  • Confirm whether firmware 5.90.1.1 is present on deployed devices.
  • Verify upload functionality is unavailable to untrusted users or networks.
  • Review web server and device logs for unusual server-interpreted uploads.
  • Document any compensating controls that block access to the upload path.
Prepared
Confidence
medium
Sources
3

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

description · low confidence lookup

Execution behavior lookup

The CVE wording references code or command execution, so execution technique review may help defensive triage. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.

Open ATT&CK lookup
cve · low confidence lookup

CVE-2018-9156 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
0Timeline events
0ADP providers
2Source links

CVSS and timeline data

No CVSS vectors or timeline events were available in the normalized CVE source material.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
n/an/an/aListed
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.