Axis Os
Monthly
Remote code execution via improper input validation in a VAPIX API parameter on Axis OS affects Axis network camera and edge device deployments. An attacker holding administrator-privileged service account credentials can send a crafted API parameter to trigger the flaw, execute arbitrary code on the device, and potentially escalate to higher privileges. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog; however, the full-impact CVSS score of 7.2 with network attack vector and high C/I/A ratings reflects the severity of a successful post-authentication compromise.
Code execution with potential privilege escalation in AXIS OS 12.0.0 through 12.10.35 is reachable only after an attacker authenticates to the device over SSH; a local configuration file with improper validation then lets that logged-in user execute code and potentially elevate privileges. Axis has released a fix in AXIS OS 12.10.36, and no public exploit was identified at time of analysis; EPSS is 0.05% (17th percentile) and CISA SSVC records no known exploitation, so the SSH credential prerequisite remains the practical gate on real-world risk.
Path traversal in AXIS OS handling of ACAP application configuration files gives a local attacker holding low-level privileges a route to elevated privileges on the device, with high confidentiality, integrity and availability impact once the traversal succeeds. Exploitation requires two non-default conditions to both hold: the Axis device must be configured to permit installation of unsigned ACAP applications (the shipped default, signed-only, blocks the attack), and the operator must be persuaded to install a malicious ACAP application carrying the crafted configuration. Axis has released a fix in AXIS OS 12.10.4; no public exploit identified at time of analysis, EPSS is 0.01% (3rd percentile), SSVC records exploitation: none and automatable: no, so this is a high-severity but low-urgency issue whose realistic exposure is confined to environments that have deliberately relaxed the unsigned-application restriction.
Command injection in the ACAP configuration-file handling of AXIS OS 12.x allows a local, authenticated attacker to escalate privileges on the device, provided the operator is first persuaded to install a crafted ACAP application. Exploitation is gated by two non-default conditions: the device must be explicitly configured to permit installation of unsigned ACAP applications (signed-only is the default posture) and the attacker must convince a victim to install the malicious package, matching the assessed vector AV:L/AC:L/PR:L/UI:R with high confidentiality, integrity and availability impact. No public exploit has been identified at time of analysis (EPSS 0.04%, SSVC exploitation: none, not in CISA KEV), and AXIS OS 12.9.33 is the vendor-released fix, making this a this_week remediation item rather than an emergency.
Privilege escalation on Axis devices running AXIS OS 12.0.0 through 12.9.31 lets a malicious ACAP (Axis Camera Application Platform) application obtain elevated privileges because input validation during the installation process is insufficient, allowing the app to be assigned permissions beyond those it should hold. Exploitation requires two conditions the vendor states explicitly: the device must be configured to permit installation of unsigned ACAP applications (not the default signed-only mode), and an authorized installer must be convinced to install the attacker's application, so the attack is local-scope and dependent on user interaction. No public exploit code was identified at time of analysis, EPSS is 0.01% (1st percentile), and CISA SSVC records exploitation as none and automatable as no, so real-world urgency is low despite high confidentiality, integrity and availability impact once the prerequisites are met; the vendor-released fix is AXIS OS 12.9.32.
Privilege escalation in the Axis Camera Application Platform (ACAP) framework on Axis OS exploits a Time-of-Check to Time-of-Use (TOCTOU) race condition during ACAP application installation. Exploitation is gated behind two explicit non-default conditions: the target device must have unsigned ACAP application installation enabled, and a high-privileged victim must be socially engineered into installing a malicious package. No public exploit code has been identified at time of analysis, and the vendor-assigned CVSS score of 5.1 (Medium) accurately reflects the high attack complexity and privilege prerequisites that substantially constrain real-world impact.
Privilege escalation in Axis OS affects all Axis network devices where unsigned ACAP application installation is permitted, allowing an attacker who tricks an administrator into installing a malicious ACAP app to gain elevated privileges on the device. The vulnerability stems from missing input validation in an ACAP configuration file (CWE-1287), enabling crafted configuration values to bypass intended privilege boundaries. No public exploit code has been identified at time of analysis, and the CVE is not listed in the CISA KEV catalog.
Privilege escalation in the Axis Camera Application Platform (ACAP) framework within Axis OS exploits a Time-of-Check to Time-of-Use race condition during application installation, allowing a malicious ACAP package to bypass integrity verification and gain elevated privileges on the device. Affected are Axis network cameras and IoT surveillance devices running all versions of Axis OS where unsigned ACAP application installation has been explicitly enabled. No public exploit code exists and the vulnerability is not listed in CISA KEV; the combination of high attack complexity, administrative victim interaction, and a non-default prerequisite configuration materially limits real-world risk.
Authentication bypass in the Device Configuration Framework of Axis OS (CWE-290) enables an already-authenticated attacker holding a viewer-privileged service account to circumvent authorization controls and gain unauthorized access to device configuration with high confidentiality and integrity impact. The vulnerability is network-exploitable but constrained by the requirement for prior authentication and high attack complexity. No active exploitation has been confirmed by CISA KEV, and no public exploit code has been identified at time of analysis.
The VAPIX API mediaclip.cgi that did not have a sufficient input validation allowing for a possible remote code execution. This flaw can only be exploited after authenticating with an operator- or administrator- privileged service account. [CVSS 7.1 HIGH]
An ACAP configuration file has improper permissions and lacks input validation, which could potentially lead to privilege escalation. Rated medium severity (CVSS 6.7), this vulnerability is low attack complexity. No vendor patch available.
An ACAP configuration file has improper permissions, which could allow command injection and potentially lead to privilege escalation. Rated medium severity (CVSS 6.7), this vulnerability is low attack complexity. No vendor patch available.
ACAP applications can gain elevated privileges due to improper input validation, potentially leading to privilege escalation. Rated medium severity (CVSS 6.7), this vulnerability is low attack complexity. No vendor patch available.
The ACAP Application framework could allow privilege escalation through a symlink attack. Rated medium severity (CVSS 6.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
An ACAP configuration file lacked sufficient input validation, which could allow a path traversal attack leading to potential privilege escalation. Rated medium severity (CVSS 6.4). No vendor patch available.
A malicious ACAP application can gain access to admin-level service account credentials used by legitimate ACAP applications, leading to potential privilege escalation of the malicious ACAP. Rated medium severity (CVSS 6.6), this vulnerability is remotely exploitable. No vendor patch available.
An ACAP configuration file lacked sufficient input validation, which could allow for arbitrary code execution. Rated medium severity (CVSS 6.7), this vulnerability is low attack complexity. No vendor patch available.
ACAP applications can be executed with elevated privileges, potentially leading to privilege escalation. Rated medium severity (CVSS 6.7), this vulnerability is low attack complexity. No vendor patch available.
An ACAP configuration file lacked sufficient input validation, which could allow for arbitrary code execution. Rated medium severity (CVSS 6.7), this vulnerability is low attack complexity. No vendor patch available.
Privilege escalation vulnerability in Axis Communications' VAPIX Device Configuration framework that allows a local, authenticated user with lower privileges to escalate to administrator-level access. Discovered during a penetration test by Truesec, this flaw affects Axis network devices and cameras utilizing the vulnerable VAPIX framework. With a CVSS score of 8.8 and local attack vector, the vulnerability poses significant risk to organizations deploying Axis devices in multi-user or untrusted environments, though it requires prior authentication and local access to exploit.
Privilege escalation in Axis VAPIX framework.
During an annual penetration test conducted on behalf of Axis Communications, Truesec discovered a flaw in the VAPIX Device Configuration framework that allowed for unauthenticated username. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
51l3nc3, a member of the AXIS OS Bug Bounty Program, has found that the VAPIX API uploadoverlayimage.cgi did not have sufficient input validation to allow an attacker to upload files to block access. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
During an annual penetration test conducted on behalf of Axis Communication, Truesec discovered a flaw in the VAPIX Device Configuration framework that could lead to an incorrect user privilege level. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
During an annual penetration test conducted on behalf of Axis Communication, Truesec discovered a flaw in the ACAP Application framework that allowed applications to access restricted D-Bus methods. Rated high severity (CVSS 8.5), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Girishunawane, member of the AXIS OS Bug Bounty Program, has found that the VAPIX API dynamicoverlay.cgi did not have a sufficient input validation allowing for a possible command injection leading. Rated low severity (CVSS 3.5), this vulnerability is remotely exploitable. No vendor patch available.
Erik de Jong, member of the AXIS OS Bug Bounty Program, has found that the VAPIX API ftptest.cgi did not have a sufficient input validation allowing for a possible command injection leading to being. Rated low severity (CVSS 2.7), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Sandro Poppi, member of the AXIS OS Bug Bounty Program, has found that the VAPIX APIs mediaclip.cgi and playclip.cgi was vulnerable for file globbing which could lead to a resource exhaustion attack. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
During internal Axis Security Development Model (ASDM) threat-modelling, a flaw was found in the protection for device tampering (commonly known as Secure Boot) in AXIS OS making it vulnerable to a. Rated medium severity (CVSS 6.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Sandro Poppi, member of the AXIS OS Bug Bounty Program, has found that the VAPIX API irissetup.cgi was vulnerable to path traversal attacks that allows for file deletion. Rated high severity (CVSS 7.1), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Sandro Poppi, member of the AXIS OS Bug Bounty Program, has found that the VAPIX API manageoverlayimage.cgi was vulnerable to path traversal attacks that allows for file/folder deletion. Rated high severity (CVSS 7.1), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Sandro Poppi, member of the AXIS OS Bug Bounty Program, has found that the VAPIX API dynamicoverlay.cgi was vulnerable to a Denial-of-Service attack allowing for an attacker to block access to the. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Sandro Poppi, member of the AXIS OS Bug Bounty Program, has found that the VAPIX API overlay_del.cgi is vulnerable to path traversal attacks that allows for file deletion. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
NCC Group has found a flaw during the annual internal penetration test ordered by Axis Communications. Rated medium severity (CVSS 6.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
GoSecure on behalf of Genetec Inc. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Knud from Fraktal.fi has found a flaw in some Axis Network Door Controllers and Axis Network Intercoms when communicating over OSDP, highlighting that the OSDP message parser crashes the pacsiod. Rated medium severity (CVSS 6.5), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
AXIS OS 11.0.X - 11.3.x use a static RSA key in legacy LUA-components to protect Axis-specific source code. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A user controlled parameter related to SMTP test functionality is not correctly validated making it possible to add the Carriage Return and Line Feed (CRLF) control characters and include arbitrary. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A user controlled parameter related to SMTP test functionality is not correctly validated making it possible to bypass blocked network recipients. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
User controlled parameters related to SMTP notifications are not correctly validated. Rated medium severity (CVSS 6.8), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
Remote code execution via improper input validation in a VAPIX API parameter on Axis OS affects Axis network camera and edge device deployments. An attacker holding administrator-privileged service account credentials can send a crafted API parameter to trigger the flaw, execute arbitrary code on the device, and potentially escalate to higher privileges. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog; however, the full-impact CVSS score of 7.2 with network attack vector and high C/I/A ratings reflects the severity of a successful post-authentication compromise.
Code execution with potential privilege escalation in AXIS OS 12.0.0 through 12.10.35 is reachable only after an attacker authenticates to the device over SSH; a local configuration file with improper validation then lets that logged-in user execute code and potentially elevate privileges. Axis has released a fix in AXIS OS 12.10.36, and no public exploit was identified at time of analysis; EPSS is 0.05% (17th percentile) and CISA SSVC records no known exploitation, so the SSH credential prerequisite remains the practical gate on real-world risk.
Path traversal in AXIS OS handling of ACAP application configuration files gives a local attacker holding low-level privileges a route to elevated privileges on the device, with high confidentiality, integrity and availability impact once the traversal succeeds. Exploitation requires two non-default conditions to both hold: the Axis device must be configured to permit installation of unsigned ACAP applications (the shipped default, signed-only, blocks the attack), and the operator must be persuaded to install a malicious ACAP application carrying the crafted configuration. Axis has released a fix in AXIS OS 12.10.4; no public exploit identified at time of analysis, EPSS is 0.01% (3rd percentile), SSVC records exploitation: none and automatable: no, so this is a high-severity but low-urgency issue whose realistic exposure is confined to environments that have deliberately relaxed the unsigned-application restriction.
Command injection in the ACAP configuration-file handling of AXIS OS 12.x allows a local, authenticated attacker to escalate privileges on the device, provided the operator is first persuaded to install a crafted ACAP application. Exploitation is gated by two non-default conditions: the device must be explicitly configured to permit installation of unsigned ACAP applications (signed-only is the default posture) and the attacker must convince a victim to install the malicious package, matching the assessed vector AV:L/AC:L/PR:L/UI:R with high confidentiality, integrity and availability impact. No public exploit has been identified at time of analysis (EPSS 0.04%, SSVC exploitation: none, not in CISA KEV), and AXIS OS 12.9.33 is the vendor-released fix, making this a this_week remediation item rather than an emergency.
Privilege escalation on Axis devices running AXIS OS 12.0.0 through 12.9.31 lets a malicious ACAP (Axis Camera Application Platform) application obtain elevated privileges because input validation during the installation process is insufficient, allowing the app to be assigned permissions beyond those it should hold. Exploitation requires two conditions the vendor states explicitly: the device must be configured to permit installation of unsigned ACAP applications (not the default signed-only mode), and an authorized installer must be convinced to install the attacker's application, so the attack is local-scope and dependent on user interaction. No public exploit code was identified at time of analysis, EPSS is 0.01% (1st percentile), and CISA SSVC records exploitation as none and automatable as no, so real-world urgency is low despite high confidentiality, integrity and availability impact once the prerequisites are met; the vendor-released fix is AXIS OS 12.9.32.
Privilege escalation in the Axis Camera Application Platform (ACAP) framework on Axis OS exploits a Time-of-Check to Time-of-Use (TOCTOU) race condition during ACAP application installation. Exploitation is gated behind two explicit non-default conditions: the target device must have unsigned ACAP application installation enabled, and a high-privileged victim must be socially engineered into installing a malicious package. No public exploit code has been identified at time of analysis, and the vendor-assigned CVSS score of 5.1 (Medium) accurately reflects the high attack complexity and privilege prerequisites that substantially constrain real-world impact.
Privilege escalation in Axis OS affects all Axis network devices where unsigned ACAP application installation is permitted, allowing an attacker who tricks an administrator into installing a malicious ACAP app to gain elevated privileges on the device. The vulnerability stems from missing input validation in an ACAP configuration file (CWE-1287), enabling crafted configuration values to bypass intended privilege boundaries. No public exploit code has been identified at time of analysis, and the CVE is not listed in the CISA KEV catalog.
Privilege escalation in the Axis Camera Application Platform (ACAP) framework within Axis OS exploits a Time-of-Check to Time-of-Use race condition during application installation, allowing a malicious ACAP package to bypass integrity verification and gain elevated privileges on the device. Affected are Axis network cameras and IoT surveillance devices running all versions of Axis OS where unsigned ACAP application installation has been explicitly enabled. No public exploit code exists and the vulnerability is not listed in CISA KEV; the combination of high attack complexity, administrative victim interaction, and a non-default prerequisite configuration materially limits real-world risk.
Authentication bypass in the Device Configuration Framework of Axis OS (CWE-290) enables an already-authenticated attacker holding a viewer-privileged service account to circumvent authorization controls and gain unauthorized access to device configuration with high confidentiality and integrity impact. The vulnerability is network-exploitable but constrained by the requirement for prior authentication and high attack complexity. No active exploitation has been confirmed by CISA KEV, and no public exploit code has been identified at time of analysis.
The VAPIX API mediaclip.cgi that did not have a sufficient input validation allowing for a possible remote code execution. This flaw can only be exploited after authenticating with an operator- or administrator- privileged service account. [CVSS 7.1 HIGH]
An ACAP configuration file has improper permissions and lacks input validation, which could potentially lead to privilege escalation. Rated medium severity (CVSS 6.7), this vulnerability is low attack complexity. No vendor patch available.
An ACAP configuration file has improper permissions, which could allow command injection and potentially lead to privilege escalation. Rated medium severity (CVSS 6.7), this vulnerability is low attack complexity. No vendor patch available.
ACAP applications can gain elevated privileges due to improper input validation, potentially leading to privilege escalation. Rated medium severity (CVSS 6.7), this vulnerability is low attack complexity. No vendor patch available.
The ACAP Application framework could allow privilege escalation through a symlink attack. Rated medium severity (CVSS 6.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
An ACAP configuration file lacked sufficient input validation, which could allow a path traversal attack leading to potential privilege escalation. Rated medium severity (CVSS 6.4). No vendor patch available.
A malicious ACAP application can gain access to admin-level service account credentials used by legitimate ACAP applications, leading to potential privilege escalation of the malicious ACAP. Rated medium severity (CVSS 6.6), this vulnerability is remotely exploitable. No vendor patch available.
An ACAP configuration file lacked sufficient input validation, which could allow for arbitrary code execution. Rated medium severity (CVSS 6.7), this vulnerability is low attack complexity. No vendor patch available.
ACAP applications can be executed with elevated privileges, potentially leading to privilege escalation. Rated medium severity (CVSS 6.7), this vulnerability is low attack complexity. No vendor patch available.
An ACAP configuration file lacked sufficient input validation, which could allow for arbitrary code execution. Rated medium severity (CVSS 6.7), this vulnerability is low attack complexity. No vendor patch available.
Privilege escalation vulnerability in Axis Communications' VAPIX Device Configuration framework that allows a local, authenticated user with lower privileges to escalate to administrator-level access. Discovered during a penetration test by Truesec, this flaw affects Axis network devices and cameras utilizing the vulnerable VAPIX framework. With a CVSS score of 8.8 and local attack vector, the vulnerability poses significant risk to organizations deploying Axis devices in multi-user or untrusted environments, though it requires prior authentication and local access to exploit.
Privilege escalation in Axis VAPIX framework.
During an annual penetration test conducted on behalf of Axis Communications, Truesec discovered a flaw in the VAPIX Device Configuration framework that allowed for unauthenticated username. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
51l3nc3, a member of the AXIS OS Bug Bounty Program, has found that the VAPIX API uploadoverlayimage.cgi did not have sufficient input validation to allow an attacker to upload files to block access. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
During an annual penetration test conducted on behalf of Axis Communication, Truesec discovered a flaw in the VAPIX Device Configuration framework that could lead to an incorrect user privilege level. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
During an annual penetration test conducted on behalf of Axis Communication, Truesec discovered a flaw in the ACAP Application framework that allowed applications to access restricted D-Bus methods. Rated high severity (CVSS 8.5), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Girishunawane, member of the AXIS OS Bug Bounty Program, has found that the VAPIX API dynamicoverlay.cgi did not have a sufficient input validation allowing for a possible command injection leading. Rated low severity (CVSS 3.5), this vulnerability is remotely exploitable. No vendor patch available.
Erik de Jong, member of the AXIS OS Bug Bounty Program, has found that the VAPIX API ftptest.cgi did not have a sufficient input validation allowing for a possible command injection leading to being. Rated low severity (CVSS 2.7), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Sandro Poppi, member of the AXIS OS Bug Bounty Program, has found that the VAPIX APIs mediaclip.cgi and playclip.cgi was vulnerable for file globbing which could lead to a resource exhaustion attack. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
During internal Axis Security Development Model (ASDM) threat-modelling, a flaw was found in the protection for device tampering (commonly known as Secure Boot) in AXIS OS making it vulnerable to a. Rated medium severity (CVSS 6.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Sandro Poppi, member of the AXIS OS Bug Bounty Program, has found that the VAPIX API irissetup.cgi was vulnerable to path traversal attacks that allows for file deletion. Rated high severity (CVSS 7.1), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Sandro Poppi, member of the AXIS OS Bug Bounty Program, has found that the VAPIX API manageoverlayimage.cgi was vulnerable to path traversal attacks that allows for file/folder deletion. Rated high severity (CVSS 7.1), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Sandro Poppi, member of the AXIS OS Bug Bounty Program, has found that the VAPIX API dynamicoverlay.cgi was vulnerable to a Denial-of-Service attack allowing for an attacker to block access to the. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Sandro Poppi, member of the AXIS OS Bug Bounty Program, has found that the VAPIX API overlay_del.cgi is vulnerable to path traversal attacks that allows for file deletion. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
NCC Group has found a flaw during the annual internal penetration test ordered by Axis Communications. Rated medium severity (CVSS 6.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
GoSecure on behalf of Genetec Inc. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Knud from Fraktal.fi has found a flaw in some Axis Network Door Controllers and Axis Network Intercoms when communicating over OSDP, highlighting that the OSDP message parser crashes the pacsiod. Rated medium severity (CVSS 6.5), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
AXIS OS 11.0.X - 11.3.x use a static RSA key in legacy LUA-components to protect Axis-specific source code. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A user controlled parameter related to SMTP test functionality is not correctly validated making it possible to add the Carriage Return and Line Feed (CRLF) control characters and include arbitrary. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A user controlled parameter related to SMTP test functionality is not correctly validated making it possible to bypass blocked network recipients. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
User controlled parameters related to SMTP notifications are not correctly validated. Rated medium severity (CVSS 6.8), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.