CVE-2024-0066: Axis O3C Information Disclosure Flaw

CVE-2024-0066 Overview

CVE-2024-0066 is an information disclosure vulnerability affecting Axis devices running AXIS OS with the O3C (One-Click Camera Connection) feature enabled. Security researcher Johan Fagerström, a member of the AXIS OS Bug Bounty Program, discovered that the O3C feature may expose sensitive traffic between the client (Axis device) and the O3C server. This vulnerability falls under CWE-319 (Cleartext Transmission of Sensitive Information), indicating that data intended to be protected is transmitted in an unencrypted manner.

Critical Impact

Sensitive network traffic between Axis devices and O3C servers may be exposed to unauthorized parties, potentially allowing attackers to intercept credentials, configuration data, or other confidential information transmitted over the network.

Affected Products

• AXIS OS devices with O3C feature enabled
• Axis network cameras and devices utilizing One-Click Camera Connection
• Devices running vulnerable AXIS OS firmware versions (see vendor advisory for specific versions)

Discovery Timeline

• 2024-06-18 - CVE-2024-0066 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2024-0066

Vulnerability Analysis

This vulnerability stems from improper handling of sensitive traffic within the O3C (One-Click Camera Connection) feature in AXIS OS. O3C is a cloud-based service that allows users to easily connect Axis devices to video management systems without complex network configuration. The vulnerability allows sensitive data transmitted between the Axis device acting as a client and the O3C server to be exposed.

The cleartext transmission issue (CWE-319) indicates that the affected component fails to properly encrypt or protect sensitive communications. An attacker positioned on the network path between the Axis device and the O3C server could potentially intercept and read sensitive information. This is particularly concerning in environments where O3C is used for remote device management and configuration.

It is important to note that organizations not utilizing the O3C feature are not affected by this vulnerability. The attack requires network-level access, making it exploitable without authentication or user interaction.

Root Cause

The root cause of CVE-2024-0066 is the cleartext transmission of sensitive information (CWE-319) within the O3C feature implementation. The O3C communication channel between Axis devices and the O3C server fails to adequately protect sensitive traffic, allowing potential interception by network-based attackers. This represents a fundamental flaw in how the O3C feature handles data confidentiality during transmission.

Attack Vector

The attack vector is network-based, requiring an attacker to be positioned along the communication path between the vulnerable Axis device and the O3C server. Potential attack scenarios include:

Man-in-the-Middle (MitM) Positioning: An attacker could intercept traffic by compromising network infrastructure, performing ARP spoofing, or leveraging access to intermediate network segments.

Network Sniffing: In environments where traffic passes through shared network segments, an attacker with passive network access could capture the exposed sensitive traffic.

Cloud Path Interception: For traffic traversing public networks to reach the O3C server, attackers with ISP-level access or compromised network nodes could intercept communications.

Since the vulnerability requires no privileges, no user interaction, and has low attack complexity, exploitation is relatively straightforward for an attacker with appropriate network positioning.

Detection Methods for CVE-2024-0066

Indicators of Compromise

• Unusual network traffic patterns between Axis devices and O3C endpoints
• Evidence of network sniffing tools or ARP spoofing activity on network segments hosting Axis devices
• Unauthorized access attempts to video management systems using captured credentials
• Anomalous login events from unexpected IP addresses following O3C communication

Detection Strategies

• Deploy network intrusion detection systems (NIDS) to monitor for suspicious traffic interception attempts on segments hosting Axis devices
• Implement deep packet inspection to identify unencrypted sensitive data transmissions from Axis devices
• Enable logging on Axis devices and correlate with network flow data to detect potential interception attempts
• Monitor for ARP spoofing, DHCP attacks, or other MitM techniques targeting network segments with Axis devices

Monitoring Recommendations

• Establish baseline network behavior for O3C communications and alert on deviations
• Deploy SentinelOne Singularity for network visibility to detect lateral movement and reconnaissance activities that may precede exploitation
• Implement network segmentation monitoring to detect unauthorized access to Axis device network segments
• Review Axis device logs for connection anomalies or failed authentication attempts that may indicate credential theft

How to Mitigate CVE-2024-0066

Immediate Actions Required

• Identify all Axis devices in your environment using the O3C feature
• Review the Axis Security Advisory for CVE-2024-0066 for specific affected versions
• Apply vendor-provided security patches immediately to all affected devices
• Consider disabling O3C functionality on devices where it is not required

Patch Information

Axis has released patched AXIS OS versions to address this vulnerability. Organizations should refer to the official Axis Security Advisory for detailed information about affected firmware versions and the corresponding patches. It is strongly recommended to update all affected devices to the latest patched firmware version as soon as possible.

Workarounds

• Disable the O3C feature on devices where remote cloud-based connectivity is not required
• Implement network segmentation to isolate Axis devices from untrusted network segments
• Deploy VPN tunnels or encrypted network overlays for Axis device communications where O3C must remain enabled
• Enable strong authentication and monitoring on all network infrastructure to detect and prevent MitM attacks

# Network isolation recommendation
# Ensure Axis devices are on a dedicated VLAN with restricted access
# Example: Configure firewall rules to limit Axis device communication paths

# Verify O3C status on Axis devices via device web interface:
# Navigate to: Settings > System > Network > O3C
# If O3C is not required, set to "Disabled"

# Monitor for cleartext traffic (example using tcpdump)
# tcpdump -i eth0 host <axis_device_ip> -w axis_traffic.pcap
# Analyze captured traffic for unencrypted sensitive data