CVE-2022-23410: Axis IP Utility RCE Vulnerability

CVE-2022-23410 Overview

CVE-2022-23410 is a DLL hijacking vulnerability in AXIS IP Utility versions prior to 4.18.0. The IPUtility.exe binary loads dynamic-link libraries (DLLs) from its current working directory without proper path validation. An attacker who places a malicious DLL in the same folder as the executable can trigger arbitrary code execution in the context of the user running the utility. The flaw enables both remote code execution and local privilege escalation depending on deployment context. The vulnerability is classified under CWE-427: Uncontrolled Search Path Element.

Critical Impact
Successful exploitation grants attackers code execution with the privileges of the user running AXIS IP Utility, potentially leading to full system compromise on Windows endpoints.

Affected Products

AXIS IP Utility versions before 4.18.0
Windows installations of IPUtility.exe
Systems where AXIS IP Utility is deployed for network camera discovery

Discovery Timeline

2022-02-14 - CVE-2022-23410 published to NVD
2024-11-21 - Last updated in NVD database

Technical Details for CVE-2022-23410

Vulnerability Analysis

The vulnerability resides in how IPUtility.exe resolves DLL dependencies at runtime. Windows applications must specify safe DLL search paths to prevent untrusted directories from being consulted during library loading. AXIS IP Utility fails to enforce this, instead allowing the current working directory to participate in the DLL search order.

When a user launches IPUtility.exe from a directory containing an attacker-controlled DLL with a name matching one of the expected dependencies, Windows loads the malicious library. The injected code then executes with the calling user's permissions. The Exploit Prediction Scoring System (EPSS) rates this issue at 0.72%, reflecting opportunistic rather than targeted exploitation likelihood.

Root Cause

The root cause is insecure library loading behavior. The application does not call SetDefaultDllDirectories() or use fully qualified paths when invoking LoadLibrary(). This produces an uncontrolled search path element, classified as [CWE-427]. Any directory writable by the attacker that also hosts the executable becomes an attack surface.

Attack Vector

Exploitation requires user interaction. An attacker delivers a payload by staging a malicious DLL alongside IPUtility.exe, typically through a compressed archive, network share, removable media, or phishing-delivered folder. When the victim launches the utility from that location, the hijacked DLL executes. In shared environments, this enables local privilege escalation if a higher-privileged user runs the utility from an attacker-writable path.

The vulnerability mechanism follows the standard DLL search-order hijacking pattern documented by Microsoft. No exploit code is published for this specific CVE, but generic DLL hijacking tooling such as Robber and DLLSpy can identify vulnerable import resolutions. Refer to the Axis Security Technical Note for vendor-confirmed technical details.

Detection Methods for CVE-2022-23410

Indicators of Compromise

Unexpected DLL files co-located with IPUtility.exe that are not part of the official AXIS installation manifest
Process creation events showing IPUtility.exe launched from user-writable directories such as Downloads, Temp, or removable media
Child processes spawned by IPUtility.exe that are inconsistent with normal camera discovery activity
Outbound network connections originating from IPUtility.exe to non-AXIS infrastructure

Detection Strategies

Monitor Windows Sysmon Event ID 7 (Image Loaded) for IPUtility.exe loading DLLs from non-standard paths
Audit Sysmon Event ID 1 (Process Create) to flag executions of IPUtility.exe from temporary or user-controlled directories
Compare loaded module hashes against known-good baselines from the official AXIS installer

Monitoring Recommendations

Enable PowerShell and command-line logging on workstations where AXIS IP Utility is installed
Forward endpoint telemetry to a centralized SIEM for correlation of DLL-load anomalies
Establish file integrity monitoring on the AXIS installation directory and any folders used to distribute the utility

How to Mitigate CVE-2022-23410

Immediate Actions Required

Upgrade AXIS IP Utility to version 4.18.0 or later on all Windows hosts
Inventory endpoints to identify legacy installations and remove orphaned copies of IPUtility.exe
Restrict execution of AXIS IP Utility to trusted administrative directories using application control policies
Educate operators to avoid launching the utility from Downloads, network shares, or removable media

Patch Information

Axis Communications released version 4.18.0 to address the DLL hijacking flaw. Patch details and download instructions are available in the Axis Security Technical Note. Administrators should validate installer signatures before deployment.

Workarounds

Run IPUtility.exe only from the protected installation directory under Program Files, which non-administrative users cannot modify
Apply Windows AppLocker or Windows Defender Application Control rules to block execution of IPUtility.exe from user-writable paths
Set the CWDIllegalInDllSearch registry key to remove the current working directory from the DLL search order system-wide

bash

# Configuration example: harden DLL search order via registry
reg add "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager" /v CWDIllegalInDllSearch /t REG_DWORD /d 0xFFFFFFFF /f