Heap-based buffer overflow in Axis A1001 Network Door Controller's OSDP communication

CVE-2023-21406

What is CVE-2023-21406?

A security flaw has been identified in the AXIS A1001 that affects its handling of communications over the Open Supervised Device Protocol (OSDP). The vulnerability manifests as a heap-based buffer overflow within the pacsiod process, which manages OSDP communications. An attacker can exploit this flaw by appending invalid data to an OSDP message, enabling them to write data beyond the limits of the allocated heap buffer. This unauthorized data manipulation poses a risk, potentially allowing for arbitrary code execution on the affected device. For further details on mitigation and impacted software versions, please consult Axis's official security advisory.

References