← Vulnerability feed

Vulnerability record · CVE-2018-10661 · published 26 June 2018

CVE-2018-10661: Axis IP Cameras access control bypass

Axis · A1001 Firmware

Multiple models of Axis IP Cameras contain an access control bypass, as reported by the vendor and third-party researchers. The flaw allows an unauthenticated network attacker to reach functionality that should require authorization, which matters because these devices are internet-facing and often used for physical security. The record gives no root-cause detail beyond 'bypass of access control'.

9.8 CVSS 3.0 Critical EPSS 87% · top 0.3%
9.8CVSS 3.0 base score, v2 10.0
87%EPSS exploitation probability, 30 days
NoNot in CISA KEV
150Affected product versions listed by NVD
8References, 4 tagged exploit
17 Jun 2026Last modified by NVD

Description

An issue was discovered in multiple models of Axis IP Cameras. There is a bypass of access control.

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: medium.

critical priorityCVSS 9.8 with no authentication or interaction required, public exploit code, and very high EPSS make this an urgent patch for any exposed Axis camera.

What it is

Multiple models of Axis IP Cameras contain an access control bypass, as reported by the vendor and third-party researchers. The flaw allows an unauthenticated network attacker to reach functionality that should require authorization, which matters because these devices are internet-facing and often used for physical security. The record gives no root-cause detail beyond 'bypass of access control'.

Impact

An attacker gains unauthorized access to camera functionality without credentials, with CVSS 3.0 scoring confidentiality, integrity and availability all High. That can expose live video and allow configuration or device manipulation.

Attack surface

Reachable over the network (AV:N) with no privileges (PR:N) and no user interaction (UI:N), so any host that can reach the camera's web or management interface can attempt it. No authentication is needed per the vector.

Exploitation

Not listed in CISA KEV, but EPSS is 0.865 (99.7th percentile) and references carry Exploit tags including an Exploit-DB entry, indicating public exploit code exists.

What to do

  • Apply the Axis firmware fix per advisory ACV-128401 and the affected product list; patch all listed camera and recorder models.
  • Do not expose camera management interfaces directly to the internet; place them behind a VPN or restricted management network.
  • Restrict access to camera HTTP/management ports with firewall rules and allow only trusted administrative hosts.
  • Replace or isolate models that no longer receive firmware updates.
  • Monitor vendor advisories for follow-up fixes on the same product line.

Detection

  • Review camera and web server logs for requests to administrative or restricted endpoints from unauthenticated or unexpected source IPs.
  • Alert on configuration changes, new user creation, or firmware actions on cameras outside change windows.
  • Baseline normal client IPs per camera and flag first-seen external addresses hitting management interfaces.
  • Watch for known exploit request patterns against Axis camera endpoints using network IDS signatures.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.

Affected products

150 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://blog.vdoo.com/2018/06/18/vdoo-discovers-significant-vulnerabilities-in-axis-cameras/ ExploitThird Party Advisory
https://www.axis.com/files/faq/Advisory_ACV-128401.pdf Vendor Advisory
https://www.axis.com/files/sales/ACV-128401_Affected_Product_List.pdf Vendor Advisory
https://www.exploit-db.com/exploits/45100/ ExploitThird Party AdvisoryVDB Entry
https://blog.vdoo.com/2018/06/18/vdoo-discovers-significant-vulnerabilities-in-axis-cameras/ ExploitThird Party Advisory
https://www.axis.com/files/faq/Advisory_ACV-128401.pdf Vendor Advisory
https://www.axis.com/files/sales/ACV-128401_Affected_Product_List.pdf Vendor Advisory
https://www.exploit-db.com/exploits/45100/ ExploitThird Party AdvisoryVDB Entry

Track CVE-2018-10661 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2018-10660Axis IP Cameras shell command injectionMultiple Axis IP camera models contain a shell command injection flaw (CWE-78). An unauthenticated remote attacker can inject operating system comman…EPSS 82%analysed9.8CVE-2018-10662Axis IP Cameras expose insecure interface allowing remote compromiseMultiple Axis IP camera models ship with an exposed insecure interface. The flaw is remotely reachable without authentication and, per the CVSS vecto…EPSS 80%analysed8.8CVE-2023-21406Axis a1001 firmware heap-based buffer overflow vulnerabilityAriel Harush and Roy Hodir from OTORIO have found a flaw in the AXIS A1001 when communicating over OSDP. A heap-based buffer overflow was found in th…EPSS 0.31%7.5CVE-2018-10658Axis a1001 firmware memory buffer overflow vulnerabilityThere was a Memory Corruption issue discovered in multiple models of Axis IP Cameras which causes a denial of service (crash). The crash arises from …EPSS 1.5%7.5CVE-2018-10659Axis a1001 firmware memory buffer overflow vulnerabilityThere was a Memory Corruption issue discovered in multiple models of Axis IP Cameras which allows remote attackers to cause a denial of service (cras…EPSS 1.8%7.5CVE-2018-10663Axis a1001 firmware information exposure vulnerabilityAn issue was discovered in multiple models of Axis IP Cameras. There is an Incorrect Size Calculation.EPSS 1.5%7.5CVE-2018-10664Axis a1001 firmware memory buffer overflow vulnerabilityAn issue was discovered in the httpd process in multiple models of Axis IP Cameras. There is Memory Corruption.EPSS 1.5%6.5CVE-2023-21405Axis a1001 firmware vulnerabilityKnud from Fraktal.fi has found a flaw in some Axis Network Door Controllers and Axis Network Intercoms when communicating over OSDP, highlighting tha…EPSS 0.30%

Source: NIST National Vulnerability Database (record CVE-2018-10661), CISA KEV, FIRST EPSS (scores of 2026-09-24). This page is refreshed as NVD updates the record.