Turning Camera Surveillance on its Axis

Enterprise IP Cameras as Perimeter Targets

Commercial IP surveillance cameras (such as Axis devices) are widely deployed across enterprise perimeters, critical infrastructure facilities, and government campuses, operating on privileged internal subnets.

Auditing Axis Camera Firmware and Daemons

Noam Moshe investigates the firmware architecture of Axis IP cameras, auditing proprietary video streaming daemons, VAPIX web APIs, and embedded ONVIF protocol services.

Unauthenticated Memory Corruption to Root Execution

Discovering critical buffer overflow and format string vulnerabilities allows unauthenticated network attackers to achieve arbitrary root code execution on camera endpoints.

Turning Cameras into Lateral Pivots

Compromised cameras allow attackers to manipulate video feeds, intercept physical access logs, and pivot deeper into segmented corporate and operational technology networks.

Remediation and Camera Network Segmentation

Securing enterprise surveillance systems requires applying vendor firmware patches, isolating camera devices onto dedicated VLANs, and disabling unnecessary cloud proxy features.