CVE-2021-31988: Axis OS SMTP Injection Vulnerability

CVE-2021-31988 Overview

CVE-2021-31988 is a CRLF (Carriage Return Line Feed) injection vulnerability affecting Axis OS, the operating system used on Axis network cameras and related devices. The flaw resides in the SMTP test functionality, where a user-controlled parameter fails to validate input. Attackers can inject CRLF control characters to add arbitrary SMTP headers into generated test emails. The vulnerability is classified under [CWE-74] (Improper Neutralization of Special Elements in Output) and [CWE-1286] (Improper Validation of Syntactic Correctness of Input).

Critical Impact

Authenticated attackers can manipulate SMTP traffic, inject malicious headers, and potentially leverage the device to send crafted emails impacting confidentiality, integrity, and availability.

Affected Products

• Axis OS (active track)
• Axis OS 2016 LTS
• Axis OS 2018 LTS
• Axis OS 2020 LTS

Discovery Timeline

• 2021-10-05 - CVE-2021-31988 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2021-31988

Vulnerability Analysis

The vulnerability exists in the SMTP test feature of Axis OS, which allows administrators to verify mail server configuration by sending a test email. The component accepts a user-supplied parameter that is concatenated directly into the SMTP message without sanitization. Because the parameter is not filtered for control characters, an attacker can embed CRLF sequences (\r\n) to terminate the current SMTP header line and inject additional headers or message body content.

The vulnerability requires user interaction and operates over the network, meaning an authenticated user with access to the SMTP test configuration interface can trigger the flaw. Successful exploitation impacts the integrity of outbound mail and may enable phishing, spoofed sender identities, or abuse of the device as a mail injection relay.

Root Cause

The root cause is missing input validation on a user-controlled SMTP test parameter. The application does not strip or reject CR (0x0D) and LF (0x0A) bytes before incorporating the value into SMTP protocol output, violating header separation rules defined in RFC 5322.

Attack Vector

An attacker submits a crafted value to the SMTP test endpoint containing embedded CRLF characters followed by attacker-controlled SMTP headers such as Bcc:, From:, or additional message content. When the device generates the test email, the injected headers are treated as legitimate, allowing the attacker to alter recipients, spoof sender fields, or append arbitrary message bodies. The exploitation mechanism is described in the Axis Technology Note CVE-2021-31988.

Detection Methods for CVE-2021-31988

Indicators of Compromise

• Outbound SMTP traffic from Axis devices containing unexpected Bcc, Cc, or From headers not configured by administrators.
• Test email log entries with parameter values containing raw %0D%0A or literal CR/LF byte sequences.
• Unusual recipients receiving mail originating from Axis camera IP addresses.

Detection Strategies

• Inspect Axis device configuration logs for SMTP test invocations with anomalous parameter lengths or non-printable characters.
• Apply network IDS signatures that flag HTTP requests to Axis administration endpoints containing URL-encoded CRLF sequences (%0d%0a).
• Correlate authentication events on Axis devices with subsequent outbound SMTP activity to identify abuse of the test feature.

Monitoring Recommendations

• Forward Axis device syslog output to a centralized SIEM for retention and correlation with email gateway logs.
• Monitor SMTP relay logs for messages originating from camera subnets, focusing on header anomalies.
• Alert on administrative logins to Axis devices from non-management network segments.

How to Mitigate CVE-2021-31988

Immediate Actions Required

• Update affected Axis devices to the firmware versions identified in the vendor advisory for each LTS track.
• Restrict administrative access to Axis devices using network segmentation and ACLs limiting management interfaces to trusted hosts.
• Enforce strong, unique credentials for all administrator accounts on Axis OS devices.
• Audit existing SMTP configurations and recently sent test emails for signs of tampering.

Patch Information

Axis Communications has released patched firmware for the affected active and LTS tracks. Refer to the Axis Technology Note CVE-2021-31988 for the specific fixed versions corresponding to Axis OS, Axis OS 2016 LTS, Axis OS 2018 LTS, and Axis OS 2020 LTS.

Workarounds

• Disable the SMTP notification and test functionality on devices that do not require email alerts.
• Place Axis devices behind an outbound SMTP relay that strips or rejects messages with malformed headers.
• Limit administrative interface exposure to a dedicated management VLAN with firewall enforcement.

# Configuration example: restrict Axis management access via iptables
iptables -A FORWARD -s 10.10.50.0/24 -d <axis_device_ip> -p tcp --dport 443 -j ACCEPT
iptables -A FORWARD -d <axis_device_ip> -p tcp --dport 443 -j DROP