Axis OS CVE-2026-6181

Exploitation requires an authenticated session using a viewer-privileged service account on the target Axis OS device - unauthenticated exploitation is not possible. The CVSS vector (AV:N/AC:H/PR:H) confirms network reachability and elevated attack complexity, indicating the bypass is not trivially triggered. Limiting factors include: (1) the attacker must possess valid viewer-tier service account credentials for the specific target device; (2) the Device Configuration Framework interface must be reachable over the network; (3) AC:H indicates some non-trivial condition or timing requirement must be met to trigger the bypass successfully. The absence of UI:N impact on scope (S:U) means the attack is self-contained to the targeted device and does not pivot to adjacent systems via this flaw alone.

The vendor-assigned CVSS score of 5.9 (AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N) reflects a genuine tension between high potential impact and significant prerequisites. The PR:H designation warrants scrutiny: in Axis OS, a viewer account is the lowest-privilege role, and classifying it as 'high privilege' is inconsistent with standard CVSS guidance where PR:H implies administrator-level control. A viewer-privileged service account is more accurately modeled as PR:L, which would raise the effective score. AC:H is appropriate given the specificity required to exploit the Device Configuration Framework bypass. No EPSS data was supplied, no KEV listing exists, and no POC is known - all three signals suggest this is not currently under broad active exploitation. Real-world risk is bounded by the need for an attacker to possess valid viewer-account credentials, either through credential theft, leaked service account secrets, or insider access. For organizations running Axis devices with externally exposed management interfaces or shared service accounts, the risk is meaningfully higher than the raw CVSS score implies.

An attacker who has obtained credentials for a viewer-privileged service account - through credential stuffing, a leaked configuration file, or insider access - connects over the network to the Device Configuration Framework on a target Axis OS device. By crafting requests that exploit the CWE-290 authentication bypass, the attacker circumvents authorization checks that should limit the viewer role, gaining the ability to read sensitive device configuration and modify settings (such as video stream routing, motion detection rules, or network parameters) without administrator credentials. No public POC is known, so this scenario currently requires knowledge of the specific bypass mechanism.