← Vulnerability feed

Vulnerability record · CVE-2018-10662 · published 26 June 2018

CVE-2018-10662: Axis IP Cameras expose insecure interface allowing remote compromise

Axis · A1001 Firmware

Multiple Axis IP camera models ship with an exposed insecure interface. The flaw is remotely reachable without authentication and, per the CVSS vector, can fully compromise confidentiality, integrity and availability. The description is thin and does not name the specific interface or root cause, so defenders must rely on the vendor advisory for scope.

9.8 CVSS 3.0 Critical EPSS 80% · top 0.4%
9.8CVSS 3.0 base score, v2 10.0
80%EPSS exploitation probability, 30 days
NoNot in CISA KEV
150Affected product versions listed by NVD
8References, 4 tagged exploit
17 Jun 2026Last modified by NVD

Description

An issue was discovered in multiple models of Axis IP Cameras. There is an Exposed Insecure Interface.

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: medium.

critical priorityCVSS 9.8 with no authentication or interaction required, very high EPSS, and public exploit code make this an urgent patch-and-isolate case.

What it is

Multiple Axis IP camera models ship with an exposed insecure interface. The flaw is remotely reachable without authentication and, per the CVSS vector, can fully compromise confidentiality, integrity and availability. The description is thin and does not name the specific interface or root cause, so defenders must rely on the vendor advisory for scope.

Impact

An unauthenticated network attacker can reach the insecure interface and, given the CVSS impact ratings, read and modify data and disrupt the device. Because these are cameras, that can mean video/feed access and device takeover.

Attack surface

Reachable over the network with no authentication and no user interaction required (AV:N/AC:L/PR:N/UI:N). Any camera exposing the affected interface to an untrusted network is in scope.

Exploitation

Not listed in CISA KEV, but EPSS is very high (0.795, ~99.6th percentile) and public exploit references exist (Exploit-DB 45100 and a VDOO blog tagged Exploit), indicating active interest and available tooling.

What to do

  • Apply the Axis firmware fix per advisory ACV-128401 and the affected product list; patch all listed camera and recorder models first.
  • Isolate cameras and recorders on a dedicated VLAN with no direct internet exposure and strict egress filtering.
  • Block or disable the insecure interface/service identified in the vendor advisory at the network boundary until patching completes.
  • Replace or retire models that no longer receive firmware updates.
  • Enforce strong unique admin credentials and disable unused services on all devices.

Detection

  • Monitor for unexpected inbound connections to camera/recorder management or service ports from untrusted networks.
  • Alert on configuration or firmware changes and new admin accounts on Axis devices.
  • Hunt for known exploit traffic patterns against Axis cameras using IDS/IPS signatures and network flow anomalies.
  • Audit exposed camera interfaces with periodic external and internal scanning.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.

Affected products

150 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://blog.vdoo.com/2018/06/18/vdoo-discovers-significant-vulnerabilities-in-axis-cameras/ ExploitThird Party Advisory
https://www.axis.com/files/faq/Advisory_ACV-128401.pdf Vendor Advisory
https://www.axis.com/files/sales/ACV-128401_Affected_Product_List.pdf Vendor Advisory
https://www.exploit-db.com/exploits/45100/ ExploitThird Party AdvisoryVDB Entry
https://blog.vdoo.com/2018/06/18/vdoo-discovers-significant-vulnerabilities-in-axis-cameras/ ExploitThird Party Advisory
https://www.axis.com/files/faq/Advisory_ACV-128401.pdf Vendor Advisory
https://www.axis.com/files/sales/ACV-128401_Affected_Product_List.pdf Vendor Advisory
https://www.exploit-db.com/exploits/45100/ ExploitThird Party AdvisoryVDB Entry

Track CVE-2018-10662 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2018-10660Axis IP Cameras shell command injectionMultiple Axis IP camera models contain a shell command injection flaw (CWE-78). An unauthenticated remote attacker can inject operating system comman…EPSS 82%analysed9.8CVE-2018-10661Axis IP Cameras access control bypassMultiple models of Axis IP Cameras contain an access control bypass, as reported by the vendor and third-party researchers. The flaw allows an unauth…EPSS 87%analysed8.8CVE-2023-21406Axis a1001 firmware heap-based buffer overflow vulnerabilityAriel Harush and Roy Hodir from OTORIO have found a flaw in the AXIS A1001 when communicating over OSDP. A heap-based buffer overflow was found in th…EPSS 0.31%7.5CVE-2018-10658Axis a1001 firmware memory buffer overflow vulnerabilityThere was a Memory Corruption issue discovered in multiple models of Axis IP Cameras which causes a denial of service (crash). The crash arises from …EPSS 1.5%7.5CVE-2018-10659Axis a1001 firmware memory buffer overflow vulnerabilityThere was a Memory Corruption issue discovered in multiple models of Axis IP Cameras which allows remote attackers to cause a denial of service (cras…EPSS 1.8%7.5CVE-2018-10663Axis a1001 firmware information exposure vulnerabilityAn issue was discovered in multiple models of Axis IP Cameras. There is an Incorrect Size Calculation.EPSS 1.5%7.5CVE-2018-10664Axis a1001 firmware memory buffer overflow vulnerabilityAn issue was discovered in the httpd process in multiple models of Axis IP Cameras. There is Memory Corruption.EPSS 1.5%6.5CVE-2023-21405Axis a1001 firmware vulnerabilityKnud from Fraktal.fi has found a flaw in some Axis Network Door Controllers and Axis Network Intercoms when communicating over OSDP, highlighting tha…EPSS 0.30%

Source: NIST National Vulnerability Database (record CVE-2018-10662), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.