CVE-2021-31987
📋 TL;DR
CVE-2021-31987 is an input validation vulnerability in Axis Communications products that allows attackers to bypass blocked SMTP recipients. This affects network devices with SMTP test functionality enabled, potentially allowing unauthorized email transmission.
💻 Affected Systems
- Axis Communications network cameras and video encoders
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Attackers could send emails through the device to any recipient, bypassing security controls, potentially enabling phishing campaigns or data exfiltration.
Likely Case
Limited email bypass allowing unauthorized messages through the device's SMTP server.
If Mitigated
No impact if SMTP test functionality is disabled or proper input validation is implemented.
🎯 Exploit Status
Exploitation requires access to the device's web interface with appropriate privileges.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: AXIS OS 9.80.3.5 and later
Vendor Advisory: https://www.axis.com/files/tech_notes/CVE-2021-31987.pdf
Restart Required: Yes
Instructions:
1. Log into Axis device web interface. 2. Navigate to System > Maintenance. 3. Check for firmware updates. 4. Install AXIS OS 9.80.3.5 or later. 5. Reboot device after installation.
🔧 Temporary Workarounds
Disable SMTP test functionality
allRemove or restrict access to the SMTP test feature in the web interface
Network segmentation
allRestrict access to device management interfaces to authorized networks only
🧯 If You Can't Patch
- Implement strict network access controls to limit who can access the device management interface
- Disable SMTP functionality entirely if not required for operations
🔍 How to Verify
Check if Vulnerable:
Check AXIS OS version via web interface: System > Options > System Options > AboutCheck Version:
Not applicable - use web interface or check device propertiesVerify Fix Applied:
Verify version is 9.80.3.5 or higher and test SMTP functionality with blocked recipients📡 Detection & Monitoring
Log Indicators:
- Unusual SMTP test attempts
- Failed recipient validation logs
- Multiple SMTP test requests
Network Indicators:
- SMTP traffic from Axis devices to unexpected recipients
- Unusual port 25 traffic from management interfaces
SIEM Query:
source="axis_device" AND (event="smtp_test" OR event="email_bypass")