Axis Communications Ab
Monthly
Remote code execution via improper input validation in a VAPIX API parameter on Axis OS affects Axis network camera and edge device deployments. An attacker holding administrator-privileged service account credentials can send a crafted API parameter to trigger the flaw, execute arbitrary code on the device, and potentially escalate to higher privileges. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog; however, the full-impact CVSS score of 7.2 with network attack vector and high C/I/A ratings reflects the severity of a successful post-authentication compromise.
Privilege escalation in the Axis Camera Application Platform (ACAP) framework on Axis OS exploits a Time-of-Check to Time-of-Use (TOCTOU) race condition during ACAP application installation. Exploitation is gated behind two explicit non-default conditions: the target device must have unsigned ACAP application installation enabled, and a high-privileged victim must be socially engineered into installing a malicious package. No public exploit code has been identified at time of analysis, and the vendor-assigned CVSS score of 5.1 (Medium) accurately reflects the high attack complexity and privilege prerequisites that substantially constrain real-world impact.
Privilege escalation in Axis OS affects all Axis network devices where unsigned ACAP application installation is permitted, allowing an attacker who tricks an administrator into installing a malicious ACAP app to gain elevated privileges on the device. The vulnerability stems from missing input validation in an ACAP configuration file (CWE-1287), enabling crafted configuration values to bypass intended privilege boundaries. No public exploit code has been identified at time of analysis, and the CVE is not listed in the CISA KEV catalog.
Privilege escalation in the Axis Camera Application Platform (ACAP) framework within Axis OS exploits a Time-of-Check to Time-of-Use race condition during application installation, allowing a malicious ACAP package to bypass integrity verification and gain elevated privileges on the device. Affected are Axis network cameras and IoT surveillance devices running all versions of Axis OS where unsigned ACAP application installation has been explicitly enabled. No public exploit code exists and the vulnerability is not listed in CISA KEV; the combination of high attack complexity, administrative victim interaction, and a non-default prerequisite configuration materially limits real-world risk.
Buffer overflow in Axis Communications' Signed Video Framework crashes applications that use its signed content validation tooling. Specifically, the Signed Media Verifier and Axis File Player are affected when processing maliciously crafted signed video content, while the AXIS OS device-side signed video functionality remains entirely unaffected. No public exploit code has been identified at time of analysis, and with CVSS 5.3 (Medium), the impact is limited to availability loss - a crash of the validation application - with no confidentiality or integrity consequences.
Authentication bypass in the Device Configuration Framework of Axis OS (CWE-290) enables an already-authenticated attacker holding a viewer-privileged service account to circumvent authorization controls and gain unauthorized access to device configuration with high confidentiality and integrity impact. The vulnerability is network-exploitable but constrained by the requirement for prior authentication and high attack complexity. No active exploitation has been confirmed by CISA KEV, and no public exploit code has been identified at time of analysis.
Improper input validation in an Axis OS configuration file allows authenticated SSH users to execute code and potentially escalate privileges. The vulnerability requires valid SSH credentials but affects all Axis OS versions, making it a significant risk for organizations running Axis network devices with SSH access exposed or shared credentials.
Privilege escalation in Axis OS via path traversal in ACAP configuration files allows high-privileged local attackers to achieve code execution with elevated permissions. The vulnerability requires the device to be configured for unsigned ACAP application installation and the attacker to socially engineer a user into installing a malicious ACAP application. CVSS 6.7 reflects high confidentiality, integrity, and availability impact, but exploitation is constrained by high-privilege requirement and user interaction. No public exploit code or active exploitation has been identified at time of analysis.
Command injection in Axis OS ACAP configuration file processing allows privilege escalation when unsigned ACAP applications are enabled and a user installs a malicious application. The vulnerability requires high-privileged user interaction and local access but bypasses normal code signing protections to achieve code execution with elevated privileges.
Axis OS allows privilege escalation via improper input validation during ACAP application installation when unsigned applications are permitted, enabling authenticated attackers with high privileges to gain elevated system access. The vulnerability requires explicit administrative configuration allowing unsigned ACAP installations and victim interaction to install a malicious application. No public exploit code or active exploitation has been confirmed at time of analysis.
Remote code execution via improper input validation in a VAPIX API parameter on Axis OS affects Axis network camera and edge device deployments. An attacker holding administrator-privileged service account credentials can send a crafted API parameter to trigger the flaw, execute arbitrary code on the device, and potentially escalate to higher privileges. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog; however, the full-impact CVSS score of 7.2 with network attack vector and high C/I/A ratings reflects the severity of a successful post-authentication compromise.
Privilege escalation in the Axis Camera Application Platform (ACAP) framework on Axis OS exploits a Time-of-Check to Time-of-Use (TOCTOU) race condition during ACAP application installation. Exploitation is gated behind two explicit non-default conditions: the target device must have unsigned ACAP application installation enabled, and a high-privileged victim must be socially engineered into installing a malicious package. No public exploit code has been identified at time of analysis, and the vendor-assigned CVSS score of 5.1 (Medium) accurately reflects the high attack complexity and privilege prerequisites that substantially constrain real-world impact.
Privilege escalation in Axis OS affects all Axis network devices where unsigned ACAP application installation is permitted, allowing an attacker who tricks an administrator into installing a malicious ACAP app to gain elevated privileges on the device. The vulnerability stems from missing input validation in an ACAP configuration file (CWE-1287), enabling crafted configuration values to bypass intended privilege boundaries. No public exploit code has been identified at time of analysis, and the CVE is not listed in the CISA KEV catalog.
Privilege escalation in the Axis Camera Application Platform (ACAP) framework within Axis OS exploits a Time-of-Check to Time-of-Use race condition during application installation, allowing a malicious ACAP package to bypass integrity verification and gain elevated privileges on the device. Affected are Axis network cameras and IoT surveillance devices running all versions of Axis OS where unsigned ACAP application installation has been explicitly enabled. No public exploit code exists and the vulnerability is not listed in CISA KEV; the combination of high attack complexity, administrative victim interaction, and a non-default prerequisite configuration materially limits real-world risk.
Buffer overflow in Axis Communications' Signed Video Framework crashes applications that use its signed content validation tooling. Specifically, the Signed Media Verifier and Axis File Player are affected when processing maliciously crafted signed video content, while the AXIS OS device-side signed video functionality remains entirely unaffected. No public exploit code has been identified at time of analysis, and with CVSS 5.3 (Medium), the impact is limited to availability loss - a crash of the validation application - with no confidentiality or integrity consequences.
Authentication bypass in the Device Configuration Framework of Axis OS (CWE-290) enables an already-authenticated attacker holding a viewer-privileged service account to circumvent authorization controls and gain unauthorized access to device configuration with high confidentiality and integrity impact. The vulnerability is network-exploitable but constrained by the requirement for prior authentication and high attack complexity. No active exploitation has been confirmed by CISA KEV, and no public exploit code has been identified at time of analysis.
Improper input validation in an Axis OS configuration file allows authenticated SSH users to execute code and potentially escalate privileges. The vulnerability requires valid SSH credentials but affects all Axis OS versions, making it a significant risk for organizations running Axis network devices with SSH access exposed or shared credentials.
Privilege escalation in Axis OS via path traversal in ACAP configuration files allows high-privileged local attackers to achieve code execution with elevated permissions. The vulnerability requires the device to be configured for unsigned ACAP application installation and the attacker to socially engineer a user into installing a malicious ACAP application. CVSS 6.7 reflects high confidentiality, integrity, and availability impact, but exploitation is constrained by high-privilege requirement and user interaction. No public exploit code or active exploitation has been identified at time of analysis.
Command injection in Axis OS ACAP configuration file processing allows privilege escalation when unsigned ACAP applications are enabled and a user installs a malicious application. The vulnerability requires high-privileged user interaction and local access but bypasses normal code signing protections to achieve code execution with elevated privileges.
Axis OS allows privilege escalation via improper input validation during ACAP application installation when unsigned applications are permitted, enabling authenticated attackers with high privileges to gain elevated system access. The vulnerability requires explicit administrative configuration allowing unsigned ACAP installations and victim interaction to install a malicious application. No public exploit code or active exploitation has been confirmed at time of analysis.