SMTP Test Function Vulnerability in Axis Communications Products
CVE-2021-31988

8.8HIGH

Key Information:

Vendor

Axis Communications Ab

Status
Axis Os
Vendor
CVE Published:
5 October 2021

What is CVE-2021-31988?

A vulnerability exists in certain Axis Communications products where user-controlled parameters related to the SMTP test functionality are insufficiently validated. This flaw allows an attacker to inject Carriage Return and Line Feed (CRLF) control characters, which can lead to the inclusion of arbitrary SMTP headers in test emails. This capability poses a risk of email spoofing and manipulation, potentially impacting the integrity and confidentiality of communications.

Affected Version(s)

AXIS OS AXIS OS 5.51 or later

References

https://www.axis.com/files/tech_notes/CVE-2021-31988.pdf
x_refsource_MISC

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.
CVE-2021-31988 : SMTP Test Function Vulnerability in Axis Communications Products