EUVD-2026-55968
GHSA-fxvq-h426-fg3c
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Network-accessible VAPIX API, low complexity once authenticated, but PR:H enforced by explicit admin credential prerequisite; full C/I/A impact from RCE plus privilege escalation.
Primary rating from Vendor (Axis).
CVSS VectorVendor: Axis
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
3DescriptionCVE.org
A VAPIX API parameter had improper input validation which could allow code execution and potentially lead to a privilege escalation. This flaw can only be exploited after authenticating with an administrator-privileged service account.
AnalysisAI
Remote code execution via improper input validation in a VAPIX API parameter on Axis OS affects Axis network camera and edge device deployments. An attacker holding administrator-privileged service account credentials can send a crafted API parameter to trigger the flaw, execute arbitrary code on the device, and potentially escalate to higher privileges. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the attacker to authenticate using an administrator-privileged service account on the target Axis OS device - this is explicitly stated in the CVE description and confirmed by CVSS PR:H. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H reflects a network-reachable, low-complexity exploit constrained to attackers who already hold administrator-level service account credentials (PR:H). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who has compromised an Axis administrator-level service account credential - through phishing, credential reuse from another breach, or insider access - authenticates to the VAPIX API over the network and sends a request containing a maliciously crafted parameter value. The improper input validation flaw allows the malicious input to trigger code execution within the context of a process running with elevated permissions, effectively giving the attacker privileged control over the Axis OS device. … |
| Remediation | The primary remediation is to consult the Axis security advisory at https://www.axis.com/dam/public/41/7d/0f/cve-2026-4757pdf-en-US-543642.pdf for the vendor-confirmed patched firmware version and to apply that update to all affected Axis OS devices. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Audit all Axis device administrator accounts and reset service account credentials, review access logs for unauthorized VAPIX API calls. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Privilege escalation in Axis VAPIX framework.
Privilege escalation vulnerability in Axis Communications' VAPIX Device Configuration framework that allows a local, aut
A user controlled parameter related to SMTP test functionality is not correctly validated making it possible to add the
During an annual penetration test conducted on behalf of Axis Communication, Truesec discovered a flaw in the ACAP Appli
Sandro Poppi, member of the AXIS OS Bug Bounty Program, has found that the VAPIX API overlay_del.cgi is vulnerable to pa
During an annual penetration test conducted on behalf of Axis Communication, Truesec discovered a flaw in the VAPIX Devi
A user controlled parameter related to SMTP test functionality is not correctly validated making it possible to bypass b
GoSecure on behalf of Genetec Inc. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attac
The VAPIX API mediaclip.cgi that did not have a sufficient input validation allowing for a possible remote code executio
Sandro Poppi, member of the AXIS OS Bug Bounty Program, has found that the VAPIX API irissetup.cgi was vulnerable to pat
Sandro Poppi, member of the AXIS OS Bug Bounty Program, has found that the VAPIX API manageoverlayimage.cgi was vulnerab
During internal Axis Security Development Model (ASDM) threat-modelling, a flaw was found in the protection for device t
Same technique Privilege Escalation
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today