EUVD-2026-55965
GHSA-xj6x-54xc-64j5
Severity by source
AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:N
PR:H reflects admin-level access needed to install ACAP apps; AC:H captures two required preconditions; UI:R mandatory; A:N because no availability impact is described.
Primary rating from Vendor (Axis).
CVSS VectorVendor: Axis
CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:N
Lifecycle Timeline
2DescriptionCVE.org
An ACAP configuration file lacks input validation, which could potentially lead to privilege escalation. This vulnerability can only be exploited if the Axis device is configured to allow the installation of unsigned ACAP applications, and if an attacker convinces the victim to install a malicious ACAP application.
AnalysisAI
Privilege escalation in Axis OS affects all Axis network devices where unsigned ACAP application installation is permitted, allowing an attacker who tricks an administrator into installing a malicious ACAP app to gain elevated privileges on the device. The vulnerability stems from missing input validation in an ACAP configuration file (CWE-1287), enabling crafted configuration values to bypass intended privilege boundaries. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires both of the following preconditions to be true simultaneously: (1) the target Axis device must be explicitly configured to permit installation of unsigned ACAP applications - this is a non-default or operator-enabled setting that must be actively turned on - and (2) the attacker must successfully socially engineer a user with device management privileges (PR:H per CVSS) into installing the malicious ACAP application (UI:R per CVSS). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 base score of 5.7 (AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:N) accurately reflects a tightly constrained exploitation window. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker targeting an organization using Axis surveillance hardware first identifies a device configured to accept unsigned ACAP applications, then crafts a malicious ACAP package whose configuration file contains unsanitized input designed to trigger privilege escalation when parsed. The attacker delivers the package via a phishing email or spoofed trusted source and persuades a device administrator to install it through the management interface, at which point the malicious configuration is processed and the attacker gains elevated privileges on the device. … |
| Remediation | Consult the Axis vendor advisory at https://www.axis.com/dam/public/21/37/f2/cve-2026-5304pdf-en-US-543644.pdf for any available patched Axis OS release; no specific fixed version number was independently confirmed from the available data, so the advisory is the authoritative source for patch version information. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Privilege escalation in Axis VAPIX framework.
Privilege escalation vulnerability in Axis Communications' VAPIX Device Configuration framework that allows a local, aut
A user controlled parameter related to SMTP test functionality is not correctly validated making it possible to add the
During an annual penetration test conducted on behalf of Axis Communication, Truesec discovered a flaw in the ACAP Appli
Sandro Poppi, member of the AXIS OS Bug Bounty Program, has found that the VAPIX API overlay_del.cgi is vulnerable to pa
During an annual penetration test conducted on behalf of Axis Communication, Truesec discovered a flaw in the VAPIX Devi
A user controlled parameter related to SMTP test functionality is not correctly validated making it possible to bypass b
Remote code execution via improper input validation in a VAPIX API parameter on Axis OS affects Axis network camera and
GoSecure on behalf of Genetec Inc. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attac
The VAPIX API mediaclip.cgi that did not have a sufficient input validation allowing for a possible remote code executio
Sandro Poppi, member of the AXIS OS Bug Bounty Program, has found that the VAPIX API irissetup.cgi was vulnerable to pat
Sandro Poppi, member of the AXIS OS Bug Bounty Program, has found that the VAPIX API manageoverlayimage.cgi was vulnerab
Same technique Privilege Escalation
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today