Axis OS Vulnerability Scanner User guide

Brand: Axis

Model: OS Vulnerability Scanner

Type: User guide

Axis OS Vulnerability Scanner is a powerful tool that enables you to assess the security posture of your Axis devices and identify potential vulnerabilities. With its advanced scanning capabilities, it provides comprehensive insights into the security risks associated with outdated software components, Apache web server configurations, and OpenSSL vulnerabilities, allowing you to take proactive measures to mitigate these risks and enhance the overall security of your network.

AXISOSVulnerabilityScannerGuide

Introduction

Vulnerabilitiesandrisks

Allsoftwarehasvulnerabilitiesthatcouldpotentiallybeexploited.Vulnerabilitieswillnotautomaticallyintroducerisk.Riskis

denedbytheprobabilityofathreatexploitingavulnerabilityandthepotentialnegativeimpactthatasuccessfulexploitcando.

Reduceanyofthetwoandyoureducetherisk.Cybersecurityisaboutmanagingrisks,andrisksareveryhardtoeliminate.Therisk

leveldependsonhowadevice/softwareisdeployed,operatedandmanaged.Reducingexposure(minimizingtheopportunity)isan

effectivewaytomitigaterisks.AXISOSHardeningGuidedescribesseveralsecuritycontrolsandrecommendationsforminimizing

riskswhendeploying,operatingandmaintaininganAxisdevice.

Somevulnerabilitiesmaybeeasytoexploitwhilesomemayrequireahighlevelofsophistication,aspecialskillsetand/ortimeand

determination.Athreatrequiresphysicalornetworkaccesstothedevice.Somevulnerabilitiesrequireadministratorprivilegesto

exploit.TheCVSS(CommonVulnerabilityScoringSystem)isacommonlyusedmeasuretohelpdeterminehoweasyavulnerability

istoexploitandthepotentialnegativeimpact.Thesescoresareoftenbasedonsoftwareincriticalsystemsorsoftwarethathas

highexposuretousersand/ortheInternet.AxismonitorstheCVE(CommonVulnerabilities&Exposure)databasewhichpublishes

knownvulnerabilitiesinsoftwarefortheCVEentriesthatrelatetotheopen-sourcepackagesusedinAxisdevices.Vulnerabilities

thatAxisidentiesaslimitedriskwillberemediedinfuturermwarereleases.VulnerabilitiesthatAxisidentiesasanincreased

riskwillbetreatedwithpriorityresultinginanunscheduledrmwarepatchorthepublishingofasecurityadvisoryinforming

abouttheriskandrecommendations.

Scanningtoolsreportingfalse-positives

Scanningtoolswilltypicallytrytoidentifyknownvulnerabilitiesbyexaminingversionnumbersofsoftwareandpackagesfound

inadevice.Thereisalwaysthepossibilitythatascanningtoolwillreportafalse-positiveremark,meaningthatthedevicedoes

notactuallyhavethevulnerability.Allremarksfromsuchscanningtoolsneedtobeanalyzedtovalidatethattheyinfactapply

tothedevice.YouneedtomakesurethattheAxisdevicehasthelatestrmwareversionasitmayincludepatchesthataddress

severalvulnerabilities.

Scope

Thisguideiswrittenfor,andcanbeappliedto,allAXISOS-basedproductsthatarerunninganAXISOSLTSoractivetrackrmware.

Legacyproductsrunning4.xxand5.xxrmwarearealsoinscope.

AXISOSVulnerabilityScannerGuide

Quickstartguide

ItisrecommendedtoperformregularvulnerabilityassessmentsoftheinfrastructuretheAxisdeviceispartofaswellasoftheAxis

deviceitself.Thesevulnerabilityassessmentsareusuallyperformedbynetworksecurityscanners.Thepurposeofavulnerability

assessmentistoprovideasystematicreviewofpotentialsecurityvulnerabilitiesandmiscongurations.Wewouldliketoemphasize

thefollowingrecommendationsbeforescanningtheAxisdeviceforvulnerabilitiesinordertomaximizethequalityofthescanning

reportaswellastoavoidcommonmistakesandfalse-positives.

•MakesurethatthermwareoftheAxisdeviceisuptodatewiththelatestavailablerelease,eitherontheAXISOS

long-termsupport(LTS)trackortheactivetrack.ThelatestavailableAXISOSrmwarecanbedownloadedhere.

•TherecommendationsinAXISOSHardeningGuideshouldbeappliedbeforescanningtoavoidfalse-positivesaswellas

makingsurethattheAxisdeviceisoperatedaccordingtoAxiscybersecurityrecommendations.

•Itisrecommendedtoperformasocalledcredentialedvulnerabilityscanwheree.g.thesecurityscannerisallowedto

logintotheAxisdeviceviaHTTP(S)orSSH.Acredentialedsecurityscanismoreeffectivesincethescansurfaceis

widenedsignicantly.

•Weemphasizetheimportanceofconductingthevulnerabilityscanusingwell-establishedpartnerswithabroadknowledge

andadedicatedsetofAxis-specicscanningpluginsonthemarket,suchasTenable,Rapid7,Qualys,orothers.

AXISOSVulnerabilityScannerGuide

Mostcommonremarks

Outdatedsoftwarecomponents

Background

Securityscannershighlightwhenadeviceisrunninganoutdatedversionofasoftwarecomponent.Itmayevenoccurthatthe

securityscannerisunabletodeterminewhatversionisactuallyrunningandagsitanyway.Thesecurityscannersimplycompares

theversionofthesoftwarecomponentsrunningontheAxisdeviceagainstthelatestavailableversion.Thesecurityscannerthen

outputsalistwithsecurityvulnerabilities,evenwithoutconrmationthatthedevicebeingtestedisreallyaffectedassuch.Thishas

beenobservedwiththeLinuxkernel,OpenSSL,Apache,BusyBox,OpenSSH,Curlandothers.

Open-sourcesoftwarecomponentsdoreceivenewfeatures,bugxesandsecuritypatchesthroughoutthecourseoftheir

development,resultinginahighreleasecycle.Therefore,itisnotuncommonthattheAxisdevicebeingtestedisnotrunningthe

latestversionofasoftwarecomponent.However,Axisismonitoringopen-sourcesoftwarecomponentsforsecurityvulnerabilities

thatcouldpotentiallybedeemedcriticalbyAxis,andwillpublishthoseaccordinglyinasecurityadvisory.

Commonreportterms

•"AvulnerableversionofLinuxwasfoundtobeutilized"

•"Accordingtoitsbanner,theversionofApacherunning"

•"Accordingtoitsbanner,theversionofOpenSSLrunning..."

•"ServerVersionDisclosure(Header)…"

Riskandrecommendations

FromAXISOS10.6andonwards,it’spossibletodisabletheOpenSSLandApacheheaderinformationbydisablingtheparameter

HTTPServerHeaderCommentsinPlaincong>System.Thismayresultinvulnerabilitiesnotbeingdetectedbysecurity

scannerssincethepackageversionisnoteasilyidentiable.Axisstronglyrecommendstokeepthedevicermwareup-to-date

andencouragestoperformsecurityauditsonyourdevices.

Apachewebserver

Background

Axisdevicesbasetheirwebinterfaceandotherweb-relatedfunctionalityontheApachewebserver.ThewebserverinAxisdevicesis

primarilybeingusedintwoscenarios:

•Forgeneralpurposemachine-to-machinecommunicationbetweentheAxisdeviceandthesystemit’sconnectedto,

usuallyavideomanagementsystemthatisaccessingtheAxisdeviceviaAPIinterfacessuchasONVIFandVAPIX.

•Theinstaller,administratorsandtheenduserperforming(initial)congurationandmaintenancetasks.

TheApachewebserverisamodule-basedopen-sourcepackage.Theseindividualmodulescancontainvulnerabilities.Belowisalist

ofmodulesthatarecommonlyloadedandusedonAxisdevices:

core_module(static)unixd_module(shared)authn_core_module

(shared)

proxy_fcgi_module

(shared)

authn_en-

coded_user_le_mod-

ule(shared)

so_module(static)alias_module(shared)authz_core_module

(shared)

proxy_http_module

(shared)

authz_urlaccess_mod-

ule(shared)

lter_module(static)rewrite_module

(shared)

authn_le_module

(shared)

proxy_wstunnel_mod-

ule(shared)

trax_module(shared)

brotli_module(static)cgid_module(shared)authz_user_module

(shared)

headers_module

(shared)

iptos_module(shared)

http_module(static)log_cong_module

(shared)

authz_owner_module

(shared)

http2_module(shared)axsyslog_module

(shared)

AXISOSVulnerabilityScannerGuide

Mostcommonremarks

suexec_module(static)setenvif_module

(shared)

auth_digest_module

(shared)

systemd_module

(shared)

ws_module(shared)

mime_module(shared)ssl_module(shared)auth_basic_module

(shared)

authn_axisbasic_mod-

ule(shared)

mpm_worker_module

(shared)

socache_shmcb_mod-

ule(shared)

proxy_module(shared)authz_axisgroup-

le_module(shared)

AvulnerabilitythatappliestoacertainmoduleinApacheneedstobeloadedandusedbytheAxisedgedevice.Vulnerabilitiesof

modulesthatarenotloadedarenotrelevant.

Commonreportterms

•"ApacheHTTPD:mod_proxy_ftpuseofuninitializedvalue(CVE-2020-1934)"

Riskandrecommendations

ApachevulnerabilitieswilltypicallyincreaseriskforpublicwebservicesexposedtoInternettargetingpublicusers.Thewebserver

inAxisdevicesshouldonlybeusedbyinstallers,administratorsandmaintainers.It’snotrecommendedtoexposeAxisdevicesto

beaccessibleovertheInternet,norshouldusershaveprivilegestouseawebbrowsertoaccessadeviceduringdailyoperations.

AdditionalsecuritycontrolssuchasIPTables,onlyallowingapprovedclientstoaccessanddisabling/preventingwebbrowsersfrom

accessingcanbeappliedtofurtherreducerisks.

OpenSSL

Background

AxisdevicesuseOpenSSLasacommonsecuritycorecomponenttoprovidesecurityfunctionalityfor,e.g.,HTTPS,certicate

andencryptionusecases."OutdatedOpenSSLversion"isacommonscanningremarkonAxisdevices,andnewvulnerabilities

arediscoveredfrequentlyinOpenSSL.

SimilartotheApachewebserver,OpenSSLisamodular-basedplatform;seebelowalistofmodulesthatarenotutilizedby

Axisproducts:

no-camelliano-heartbeatsno-mdc2no-srp

no-capiengno-hwno-rc5no-zlibthreads

no-dtlsno-ideano-sctp

no-dtls1no-md2no-seed

AvulnerabilitythatappliestoacertainmoduleinOpenSSLneedstobeloadedandusedbytheAxisedgedevice.Vulnerabilitiesof

modulesthatarenotloadedarenotrelevantbutmaystillbeaggedbythescanningtool.

Riskandrecommendations

VulnerabilitiesinOpenSSLdonotposeanyrisksifthesystemisnotusingservicessuchasHTTPSor802.1x(TLS),SRTP(RTSPS)

orSNMPv3.ItisnotpossibletocompromisethedeviceitselfasapotentialattackwouldtargettheTLSconnectionsandtrafc.

ExploitingOpenSSLvulnerabilitiesrequiresaccesstothenetwork,ahighskillsetandalotofdetermination.

Self-signedcerticate

Background

Axisdevicescomewithaself-signedcerticatethatisgeneratedautomaticallyuponrstbootinordertoprovidethepossibilityto

accesstheproductviaencryptedHTTPSconnectionandproceedwiththeinitialsetupoftheproduct.Securityscannersmayhighlight

theexistenceoftheself-signedcerticateasinsecureandAxisrecommendsremovingtheself-signedcerticatefromthedevice

andreplacingitwithaservercerticatethatistrustedinyourorganization.Theself-signedcerticateprovidesinthatsensea

condentialandsecuremechanismforinitialcongurationbutrequirestheusertostillchecktheauthenticityofthedeviceitself.

Commonreportterms

•"SSLCerticateCannotBeTrusted..."

AXISOSVulnerabilityScannerGuide

Mostcommonremarks

•"SSLSelf-SignedCerticat"

•"X.509CerticateSubjectCNDoesNotMatchtheEntityName..."

Riskandrecommendations

Self-signedcerticatesprovidenetworkencryptionbutdonotprotectfromman-in-the-middleattacks(arougeservice

impersonatingalegitimatenetworkservice).IfusingserviceslikeHTTPSor802.xit’srecommendedtouseCerticateAuthority(CA)

signedcerticates.ThesemustbesuppliedbythesystemownerusingapublicorprivateCA.IfnotusingHTTPSor802.1xthereare

norisks,andvulnerabilitiesintheunderlyingOpenSSLcannotbeusedtocompromisetheAxisdevice.ForAxisdevicesfeaturesAxis

EdgeVault,theself-signedcerticatewasreplacedbytheIEEE802.1ARdeviceIDcerticate.

RSAkeylength

Background

AsAxisdevicescomewithapre-loadedself-signedcerticate,somedeviceshaveashorterkeylengthforthecerticatethanthe

2048-bits.Thecerticateisalsoofanon-standardbitlengthtoensuremostreputableCA’swillrejectasigningrequestofthis.

Securityscannersmayhighlightthisasinsecureanditisrecommendedtoreplacethiscerticatebeforeproductiondeploymentas

itisonlyintendedforinitialsetup.

Commonreportterms

•"SSLCerticateChainContainsRSAKeysLessThan2048bits..."

•"LengthofRSAmodulusinX.509certicate:1536bits(lessthan2048bits)..."

Riskandrecommendations

Thisvulnerabilitycannotbeusedtocompromisethedevice.Thedefaultself-signedkeylengthofAxisdevicesissetto1536bitsin

ordertoreducetheconnectionlatencyandtimetogeneratethecerticateandkey.Thiskeylengthprovidesenoughprotectionfor

administrativetaskssuchasresettingdeviceaccountpasswordsandinitialsetupoftheAxisdevice.It’srecommendedtoreplacethe

defaultcerticatewithaCA-signedcerticatethatshouldbeprovidedbythesystemowner.

Ciphersettings

Background

Throughoutregularrmwareupdates,thelistofavailableciphersoftheAxisdevicemayreceiveupdateswithouttheactualcipher

congurationbeingchanged.Changingciphercongurationmustbeuser-initiated,eitherbyperformingafactorydefaultofthe

Axisdeviceorviamanualuserconguration.FromAXISOS10.8andonwards,thelistofciphersisautomaticallyupdatedwhen

theuserinitiatesarmwareupdate.

Commonreportterms

•"WeakCryptographicKey…"

•"TLS/SSLServerSupportsTheUseofStaticKeyCiphers…"

ItisrecommendedtoalwaysusethestrongestciphersforHTTPSencryptionwhenpossible.

TLS1.2andlower:WhenusingTLS1.2orloweryoucanspecifytheHTTPScipherstobeusedinPlainCong>HTTPS>Ciphersfollowed

byarestartoftheAxisdevice.Axisrecommendstoselectalloranyofthefollowingstrong-consideredciphers(updatedSeptember

2021),ortodoadesiredselectionofyourown.

ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-

SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-

POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384

TLS1.3:WhenusingTLS1.3,theHTTPSciphersparameterinPlainConghasnoeffectasperdefault,onlystrongciphersaccording

toTLS1.3willbeselected.Theselectioncannotbechangedbytheuserandisupdatedthrougharmwareupdateifneeded.

Currentlytheciphersare(updatedSeptember2021):

TLS_AES_128_GCM_SHA256:TLS_CHACHA20_POLY1305_SHA256:TLS_AES_256_GCM_SHA384

AXISOSVulnerabilityScannerGuide

Webserverremarks

Boawebserver

Background

Axisdeviceswithrmwareversion5.65andlowerutilizetheBoawebserverforwebinterfaceandweb-relatedfunctionality.The

webserverinAxisdevicesisbeingprimarilyusedintwoscenarios:

•Forgeneralpurposemachine-to-machinecommunicationbetweentheAxisdeviceandthesystemitisconnectedto,

usuallyavideomanagementsystemthatisaccessingtheAxisdeviceviaAPIinterfacessuchasONVIFandVAPIX.

•Forcongurationandmaintenancetasksperformedbyinstallers,administratorsandendusers.

SimilartothenewerApachewebserverthatisutilizedbyAxisdeviceswithnewerrmware,theBoawebservercanbeaffectedby

vulnerabilities.SecurityscannersmaynotrecognizethewebserverusedinolderAxisdevicesandwillthereforesimplyassume

thatthesedevicesutilizetheApachewebserver.AvulnerabilitythatappliestotheApachewebserverdoesnotapplytotheBoa

webserverbydefaultifnotstatedotherwise.

Commonreportterms

•"Accordingtoitsbanner,theversionofApacherunning..."

•"TheversionofApachehttpdinstalledontheremotehostispriorto2.4.46.Itis,therefore,affectedbymultiple

vulnerabilities..."

ApacheStrutsandApacheTomcat

Background

AsdescribedinApachewebserveronpage4,Axisdevicesbasetheirwebinterfaceandweb-relatedfunctionalityontheopen-source

Apachewebserver.OtheravorsoftheApachewebserverexist,suchasApacheStrutsorTomcat,butarenotutilizedinAxisdevices.

Axisutilizestheplainopen-sourceApachewebserverimplementationoftheApacheSoftwareFoundation(ASF).

Commonreportterms

•"AvulnerabilityhasbeendiscoveredinApacheTomcat..."

•"TheJakartamultipartparserinApacheStruts..."

Webusersessions

Background

Axisdevicesbasetheirwebinterfaceandotherweb-relatedfunctionalityontheApachewebserver.ThewebserverinAxisdevicesis

primarilybeingusedintwoscenarios:

•Forgeneralpurposemachine-to-machinecommunicationbetweentheAxisdeviceandthesystemit’sconnectedto,which

usuallyisavideomanagementsystemthatisaccessingtheAxisdeviceviaAPIinterfacessuchasONVIFandVAPIX.

•Whentheinstaller,administratorsandtheenduserperform(initial)congurationandmaintenancetasks.

Currently,Axisdevicesdonotsupporttraditionalwebuserbasedsessionswhereit'spossibleforthewebsessiontoe.g.logoutor

automaticallyexpireafteracertainamountoftimeofuser-inactivitywhilethebrowserwindowisopen.Everyrequestthroughthe

webserveronanAxisdevicehastobeauthenticatedproperlyinordertobeprocessedbeforethespecicwebsessionisopenfor

furthercommunication.Inordertoactivelycloseawebsession,thebrowserhastobeclosed.

Commonreportterms

•"ConcurrentUserSessions…"

•"InsufcientSessionTerminationandExpiry…"

•"ApplicationLacksLogoutFeature…"

AXISOSVulnerabilityScannerGuide

Webserverremarks

Riskandrecommendations

Axisrecommendstoaccessthedevicethroughanapplication,suchasavideomanagementsystem(VMS),asprimaryvideoclient

insteadofusingthewebbrowserifthiswouldbesubjectofconcerns.However,ifthewebbrowseristheonlyvideoclientavailable,

havethefollowingguidelinesinmind:

•Donottovisituntrustedwebsitesoropene-mailsfromuntrustedsenders(thisisofcourseageneralcyberprotection

recommendation).

•Useadifferentbrowser,whichisnotthesystemdefault,toconguretheAxisdevice.

•Createavieweraccountonthedeviceandusethiswhenviewingthevideostream.Thevieweraccounthasminimal

privilegesandnorightstochangethecongurationoftheAxisdevice.

•Donotleavethebrowseropenunattendedaftercongurationinordertominimizetheattackwindow.

AXISOSVulnerabilityScannerGuide

Firmwareremarks

Axisrmwareversionstring

Background

Axisdisclosesvulnerabilitiesandprovidesupdatedrmwarewithsecurityxessothatcustomerscanupdateandmitigatepotential

risks.SecurityscannersusuallyperformonlyalimitedcomparisonofthermwareversiontheAxisproductisrunningagainstolder,

outdatedrmwarethatmaycontainvulnerabilities.AsecurityscannermaynotrecognizetheAxisrmwarecorrectly,causingthe

scannertoagthermwarerunningasvulnerableorinsecure.Alwaysconsultthereleasenotesforthermwareversionofthe

productbeingtestedsinceseriousorcriticalvulnerabilitypatchesarelistedinthisdocument.

ItmaycauseconfusioniftheAxisdeviceisrunningacustomrmwareversionorifthesecurityscannerisnotupdatedwiththe

latestinformationofavailableAxisrmware.BelowaresomeexamplesofAxisrmwareversionstrings:

•9.70.1

•9.70.1_beta

•9.70.1.5

Commonreportterms

•"AxisMultipleVulnerabilities(ACV-128401)..."

Linuxdistributionandbuilt-inpackagemanager

Background

Securityscannersmaysupportasocalled"credentialedscan"usinglogindataviaweb-login(HTTP)orviathemaintenanceaccess

(SSH)inordertogetmoreinformationaboutthedevice,itsoperatingsystemandothersoftwarethatmightrunonit.TheLinux

distributionisaPoky(OpenEmbedded)versionwithbothlocalandupstreampatchesthatmaynotmatchorcanberecognized

assuchbythesecurityscanner.Furthermore,thesecurityscannermayexpecttheusageofapackagemanager,whichisnot

usedinAxisproducts.

BelowisacomparisonofthenamingschemebetweentheAxis-useddistributionandastandardLinuxdistribution.Notethatthe

lattermayberecognizedbythesecurityscannerandpasswhiletheAxisversionmaynot.Toillustratethis,wehavetheAxis-specic

4.9.206-axisandLinux-generic54.9.206-genericversionstrings.

Commonreportterms

•"LocalsecuritycheckshaveNOTbeenenabledbecausetheremoteLinuxdistributionisnotsupported..."

Unencryptedrmwareandchip

Background

SecurityscannersmayhighlighttheusageofashchipsusedintheAxisdeviceandmarkthemorthelesystemsassuchwith

"unencrypted".Axisdevicesdoencryptusersecretssuchaspasswords,certicates,keysandotherleswithoutnecessarilyencrypting

thelesystem.RemovablelocalstoragesuchasSDcardsareencryptedusingLUKSencryption.

Commonreportterms

•"Theashchipthatcontainstherootlesystemofthedeviceisnotencrypted...."

•"Informationwasextractedfromtheunencryptedrmwareimage,including...."

Riskandrecommendations

Thisvulnerabilitycannotbeusedtocompromisethedevice.Thermwaredoesnotcontainanysecretsbydefaultandneedsnoother

protectionthanthermwaresignaturetovalidatetheintegrity.Encryptedsoftwaremakesitharderforsecurityresearchersto

identifynew(unknown)vulnerabilities,andencryptedsoftwaremaybeusedbyvendorstohidedeliberateaws(securitythrough

obscurity).ForAxisdevices,rootaccessisrequiredtoaccessthelesystemofthedevicetogainaccesstoit.Sensitiveinformation

suchaspasswordsarestoredencryptedonthelesystemandrequireahighlevelofsophistication,skillset,timeanddetermination

AXISOSVulnerabilityScannerGuide

Firmwareremarks

toextract.Makesuretouseastrongrootpasswordandkeepitprotected.Usingthesamepasswordformultiplecamerassimplies

managementbutincreasestheriskifonecamera’ssecuritybeingcompromised.

Bootloader

Background

SecurityscannersmaybelievethattheyhaveidentiedthemakeandmodelofthebootloaderimplementationusedinAxisdevices

andcouldthereforehighlightvulnerabilitiesrelatedtosecurebootorthebootloaderitself.Axisnetworkvideoandnetworkaudio

productsutilizeanin-housedevelopedbootloaderreferredtoasnandboot/netboot.

Commonreportterms

•"AvulnerabilityinallversionsoftheGRUB2bootloaderhasbeendetected..."

•"AnissuewasdiscoveredinDasU-Bootthrough2019.07..."

AXISOSVulnerabilityScannerGuide

Networkremarks

TCP/ICMPtimestampresponse

Background

WhileTCPandICMPtimestampinformationismostoftenusedasnetworktoolstomeasureperformanceandavailabilityofhosts,it

canalsobeusedtondtime-relatedinformationaboutthenetworkdeviceitself.TheICMPtimestampinformationinICMPtype13

(timestamprequest)andICMPtype14(timestampreply)communicationprovidesinformationthatcouldbeusedtocalculatethe

actualdevicetimeinUTC.TheTCPtimestampinformationcanbeusedtocalculatethesocalledround-triptime(RTT)information

betweentwonetworkhosts,whichwouldmakeitpossibletocalculatethecurrentuptimeoftheAxisdevice.

SecurityscannersmayagtheexistenceofTCPandICMPtimestampresponsesfromAxisdevicesandrecommendtodisableTCPand

ICMPtimestampresponseswheneverpossible.AxisfollowstherecommendationoftheLinuxopen-sourcecommunitywhichdoes

notconsidertheactualdate/timeinformationprovidedfromtheseresponsesasasecurityriskbyitself.ThereforetheTCP/ICMP

timestampresponsesarestillenabledbydefault.Furthermore,innewerLinuxKernelversionstheactualcalculationisconsidered

unreliableascounter-measuresensuretomakeitunreliabletocalculatethedate/timeinformation.Asoftoday(February2022),no

knownvulnerabilitiesorexploitshavebeendisclosedthatwouldjustifydisablingtheseservicesinAxisdevices.

Commonreportterms

•"TCPtimestampresponsefound…"

•"ICMPtimestampresponsefound…"

HTTP(S),HSTSpolicy

Background

AxisdevicesareconguredbydefaulttoallowHTTPandHTTPSconnections.Itisrecommendedtomakeuseoftherst-boot

generatedself-signedcerticateinordertoperformtherstinitialcongurationoftheAxisdeviceinHTTPSmodeandtoswitchthe

congurationtoonlyallowforHTTPSconnections.HTTPScanbeenforcede.g.fromthewebinterfaceoftheAxisdevicefollowing

Settings>System>Security.Furthermore,usingHSTS(HTTPStrictTransportSecurity)tofurtherincreasedevicesecurityis

automaticallyenabledonlywhentheAxisdeviceisoperatedinHTTPS-onlymode.HSTSissupportedinthe2018LTS(8.40),

2020LTS(9.80)andtheAXISOS10.1activetrack.

SecurityscannersmayhighlightthattheAxisdevicebeingtestedisconguredtoallowHTTPonlyorHTTP&HTTPSatthesame

time.ThedetectionisusuallyperformedbyvalidatingtheresponsefromandcheckingtheportstatusofthestandardHTTPport

80.AxisrecommendstousethedeviceinHTTPSmodeonlybyconguringthisaccordingly.Manysecurityscannerauditsare

performedonAxisdeviceswherethisspecicHTTPS-onlycongurationisnotenforcedbyallowingtheAxisdevicetorespond

toHTTPand/orHTTPSconnections.

Commonreportterms

•"HTTP(Port80)insecurechanneldetected..."

•"WebPortalAllowsUnencryptedHTTPConnectionsByDefault..."

•"TheremotewebserverisnotenforcingHSTS,asdenedbyRFC6797..."

•"InsufcientTransportLayerSecurity…"

AXISOSVulnerabilityScannerGuide

Hardwareremarks

Architecturevulnerabilities

Background

Certainvulnerabilitiesmaydependontheprocessorarchitecturethatadeviceisusing.Axisedgedevices,suchascameras,

encoders,wearables,audioandintercomproducts,arebasedonMIPSandARMarchitectureandare,e.g.,notaffectedbyx64or

x86architecture-basedvulnerabilities.

Commonreportterms

•"OpenSSLrsaz_512_sqroverowbugonx86_64(CVE-2019-1551)..."

•"x64_64Montgomerysquaringprocedure..."

UART/Serialconsole

Background

PhysicalinspectionofthehardwareofanAxisdevicemayhighlighttheexistenceofaUART(UniversalAsynchronousReceiver

Transmitter)orserialconsole.Axisreferstothisasadebugport.Thedebugportisonlyusedfordevelopmentanddebugging

purposesduringengineeringprojects.Whilenosensitiveinformationisexposedwhilebeingunauthenticated,theaccesstothe

debugportispasswordrestrictedandonlytherootusermaylogin.FromAXISOS10.11andonwards,theUART/serialconsoleis

disabledbydefaultandcanonlybeenabledafterunlockingitviaadevice-uniquecustomrmwarecerticate.Thisisprovidedby

Axisonlyandcannotbegeneratedinanyotherway.

Commonreportterms

•"InformationDisclosureviaUART/SerialConsole..."

•"RootShellviaUART/SerialConsole..."

•"OnthePCB,theheadersexposedaUARTconsole..."

Ver.M3.2

AXISOSVulnerabilityScannerGuideDate:August2022

Axis OS Vulnerability Scanner User guide

Axis OS Vulnerability Scanner User guide

Axis OS Vulnerability Scanner User guide

Related papers

Other documents