0RWELLL4BS ********** security advisory olsa-2015-8258 PGP: 79A6CCC0 @orwelllabs Advisory Information ==================== - Title: ImagePath Resource Injection/Open script editor - Vendor: AXIS Communications - Research and Advisory: Orwelllabs - Class: Improper Input Validation [CWE-20] - CVE Name: CVE-2015-8258 - Affected Versions: Firmwares versions [..SNIP..] function listVideoSources() { var formInt = document.listFormInt; var formExt = document.listFormExt; var formCrop = document.listFormCrop; var presetForm = document.listFormPreset; var form = document.WizardForm var currentPath = 'http://www.3vilh0st.com/evilcode.html'; var imageSource; [..SNIP..] var reload = false; reload |= (other != null && other.search("seq=yes") >= 0); reload |= (other != null && other.search("streamprofile=") >= 0); reload |= ((other == null || (other != null && other.search("streamprofile= ;)(r") == -1)) && ('' != "")); reload |= (imagePath != 'http://www.3vilh0st.com/evilcode.html'); [..SNIP..]