EUVD-2026-55964
GHSA-h429-j7q3-6227
Severity by source
AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:N
Admin-level victim must actively install the malicious app (PR:H, UI:R); race condition requires precise timing (AC:H); privilege escalation impacts confidentiality and integrity with no availability impact described.
Primary rating from Vendor (Axis).
CVSS VectorVendor: Axis
Lifecycle Timeline
2DescriptionCVE.org
The ACAP framework contains a Time-of-Check to Time-of-Use (TOCTOU) race condition, which could potentially lead to privilege escalation. This vulnerability can only be exploited if the Axis device is configured to allow the installation of unsigned ACAP applications, and if an attacker convinces the victim to install a malicious ACAP application.
AnalysisAI
Privilege escalation in the Axis Camera Application Platform (ACAP) framework within Axis OS exploits a Time-of-Check to Time-of-Use race condition during application installation, allowing a malicious ACAP package to bypass integrity verification and gain elevated privileges on the device. Affected are Axis network cameras and IoT surveillance devices running all versions of Axis OS where unsigned ACAP application installation has been explicitly enabled. No public exploit code exists and the vulnerability is not listed in CISA KEV; the combination of high attack complexity, administrative victim interaction, and a non-default prerequisite configuration materially limits real-world risk.
Technical ContextAI
The ACAP (Axis Camera Application Platform) is an embedded application runtime shipped within Axis OS (CPE: cpe:2.3:a:axis_communications_ab:axis_os:*:*:*:*:*:*:*:*), enabling third-party applications to run on Axis network cameras and IoT devices. CWE-367 (Time-of-Check to Time-of-Use) describes a race condition where the framework performs a security check - in this context, verifying the integrity or signature of an ACAP application package - and then uses or executes the application; an attacker who can control the application package on disk can substitute a malicious payload between the check and the use, bypassing verification. This class of vulnerability is particularly difficult to defend against at the framework level without atomic check-and-execute primitives or cryptographic binding of the checked artifact to its execution context. The vulnerability is gated on the device operating in a relaxed trust mode where unsigned applications are permitted.
RemediationAI
Consult the Axis vendor advisory at https://www.axis.com/dam/public/d5/e8/6e/cve-2026-5303pdf-en-US-543643.pdf for patched Axis OS versions - no specific fix version was independently confirmed from the data available at time of analysis; obtain the exact remediated release from the Axis advisory before scheduling upgrades. The single most impactful compensating control is to disable the option to install unsigned ACAP applications on all Axis devices; this directly eliminates the attack surface described in the CVE, since exploitation is explicitly conditional on this non-default setting being active. Restricting installation to cryptographically signed, vendor-verified ACAP packages is both the primary workaround and a security best practice regardless of patch status. Additionally, restrict access to device administration and application management interfaces to a minimal set of authorized personnel, enforce MFA on management accounts, and segment camera management networks from general corporate access to reduce the social engineering surface.
Privilege escalation in Axis VAPIX framework.
Privilege escalation vulnerability in Axis Communications' VAPIX Device Configuration framework that allows a local, aut
A user controlled parameter related to SMTP test functionality is not correctly validated making it possible to add the
During an annual penetration test conducted on behalf of Axis Communication, Truesec discovered a flaw in the ACAP Appli
Sandro Poppi, member of the AXIS OS Bug Bounty Program, has found that the VAPIX API overlay_del.cgi is vulnerable to pa
During an annual penetration test conducted on behalf of Axis Communication, Truesec discovered a flaw in the VAPIX Devi
A user controlled parameter related to SMTP test functionality is not correctly validated making it possible to bypass b
Remote code execution via improper input validation in a VAPIX API parameter on Axis OS affects Axis network camera and
GoSecure on behalf of Genetec Inc. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attac
The VAPIX API mediaclip.cgi that did not have a sufficient input validation allowing for a possible remote code executio
Sandro Poppi, member of the AXIS OS Bug Bounty Program, has found that the VAPIX API irissetup.cgi was vulnerable to pat
Sandro Poppi, member of the AXIS OS Bug Bounty Program, has found that the VAPIX API manageoverlayimage.cgi was vulnerab
Same technique Privilege Escalation
View allShare
External POC / Exploit Code
Leaving vuln.today