AXIS OS EUVD-2026-29385

Two concrete, non-default prerequisites must both hold: (1) the Axis device must be configured to allow installation of UNSIGNED ACAP applications (signed-only, the default posture, blocks this), and (2) an attacker must convince the victim/operator to install a specially crafted malicious ACAP application whose configuration file carries the path-traversal payload. Limiting factors: exploitation is local (AV:L) and requires existing low-level privileges (PR:L) plus active user interaction (UI:R) to perform the install; there is no network-reachable or unauthenticated path, which substantially narrows realistic exposure to environments that have deliberately relaxed the unsigned-app restriction.

This is a genuinely high-severity but low-urgency, hard-to-exploit issue, and the signals are consistent rather than conflicting. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:R, 7.3) describes a local, authenticated attack that requires user interaction, not a remotely reachable flaw; the C:H/I:H/A:H impact and the SSVC 'Technical Impact: total' both reflect the privilege-escalation outcome, not ease of access. SSVC further states Exploitation: none and Automatable: no, which aligns with the very low EPSS (0.01%, 3rd percentile) and the absence of any CISA KEV listing. There is no public exploit reference in the supplied data. The practical risk is gated hard by two non-default preconditions (unsigned ACAP installation must be enabled, and a victim must be socially engineered into installing a malicious app), so despite the 'total' technical impact this is a targeted, operator-assisted scenario rather than a mass-exploitable threat. The vuln.today 'this_week' priority is appropriate: patch on a normal cycle, not as an emergency. No key signals conflict; the main caveat is that exploitation mechanism detail beyond 'path traversal in an ACAP configuration file' is not provided.

An attacker crafts a malicious ACAP application whose configuration file contains path-traversal sequences and convinces an operator of an Axis device-one configured to permit unsigned ACAP apps-to install it. On installation the traversal lets the app write or read outside its intended sandbox, escalating from the application's limited privileges to fuller control of the device. No public exploit code is identified in the available sources, and exploitation requires both the non-default unsigned-app setting and successful social engineering.