Axis Network Camera 2.40 and earlier, and Video Server 3.12 and earlier, allows remote attackers to execute arbitrary commands via accent (`) and possibly other shell metacharacters in the query string to virtualinput.cgi.
Affected Platforms
Axis 2420 Network CameraAxis 250S Video ServerAxis 2411 Video ServerAxis 2100 Network CameraAxis Storpoint CdAxis 2420 Video ServerAxis 2490 Serial ServerAxis 2401 Video ServerAxis 2400 Video ServerAxis 2460 Network Dvr