AXIS OS CVE-2026-0802

Exploitation requires two specific, non-default preconditions stated in the advisory: (1) the Axis device must be explicitly configured to allow installation of UNSIGNED ACAP applications - signed-only configuration (the default posture) blocks this; and (2) the attacker must convince the victim/operator to install a malicious ACAP application (user interaction, UI:R). Exploitation is local (AV:L) and requires existing privilege to reach the app-install mechanism (PR:L). These limiting factors - non-default unsigned-app setting plus required social engineering of a privileged operator - substantially reduce realistic risk below what the 7.3 base score alone suggests. Affected: AXIS OS 12.0.0 up to (not including) 12.9.33; updating to 12.9.33 is the vendor-provided fix.

This is a legitimately high-severity flaw (CVSS 7.3, with C:H/I:H/A:H and SSVC Technical Impact rated 'total') but a genuinely low-priority real-world risk, and the signals are consistent rather than conflicting. The CVSS vector is AV:L/AC:L/PR:L/UI:R, meaning exploitation is local, requires some level of existing privilege, and depends on victim interaction - it is NOT a remotely exploitable, unauthenticated issue. EPSS is 0.04% (12th percentile), SSVC Exploitation status is 'none' and Automatable is 'no', and there is no CISA KEV listing and no public exploit identified at time of analysis. These low-exploitation signals align with the heavy preconditions in the description (device must be configured to allow unsigned ACAP apps, and the victim must be socially engineered into installing a malicious app), so the high technical impact is gated behind conditions an attacker cannot satisfy opportunistically. The vuln.today 'this_week' decision label reflects the total technical impact and vendor patch availability, not active exploitation. Net: a real issue worth patching on a normal cycle, not an emergency, driven almost entirely by preconditions rather than attacker capability.

An attacker crafts a malicious ACAP application and socially engineers an operator of an Axis device - one that has been configured to permit installation of unsigned ACAP apps - into installing it. The malicious application abuses the ACAP configuration file's insufficient input validation (CWE-1287) to inject commands and potentially escalate privileges on the device. Because the CVSS vector is local with required user interaction (AV:L/UI:R) and no public exploit is identified at time of analysis, this is a social-engineering-dependent rather than opportunistic attack.