Smart cameras with enhanced connectivity, communication and analytics capabilities are widely used for several purposes, including distributed situational awareness and physical security. Combining traditional video recording with advanced software features, these devices allow for the implementation of advanced use-cases such as facial recognition, real-time environmental monitoring, motion detection and license plate verification. Recently, Nozomi Networks Labs performed a security research activity focused on the License Plate Verifier software product offered by Axis Communications.
Axis Communications is a leader in the sector of security cameras dedicated to a wide range of industries such as aviation, smart cities, healthcare etc. Their products include network cameras, wearable systems, access control systems, and more. They also have a solution that enables compatible devices to implement access control rules based on license plate recognition. Ideally, the solution can be used to enforce automatic access control on restricted outdoor areas or limited traffic zones, similar to badge scanning and facial recognition for building access controls.
Nozomi Networks Labs had the opportunity to analyze the License Plate Verifier application software on an Axis security camera model P3245-LVE-3, however, the software can be installed to a wider range of Axis devices. In this blog, we disclose six vulnerabilities that affect the License Plate Verifier application version 2.7.1 (latest release at the time of the analysis) installed on all compatible Axis devices. These issues could allow an attacker to exfiltrate credentials to access additional systems, elevating privileges to reach forbidden functionalities and gain arbitrary code execution with full privileges on the device. Nozomi Networks Labs notified the vendor in May 2023, and they responded by sharing additional details together and a timeline for updating the License Plate Verifier application... Read More!
