Remote code execution vulnerability during the installation of ACAP applications on the Axis device
CVE-2023-21413

7.2HIGH

Key Information:

Vendor

Axis Communications Ab

Status
Axis Os
Vendor
CVE Published:
16 October 2023

What is CVE-2023-21413?

A serious vulnerability in AXIS OS has been identified, which allows for remote code execution during the installation of ACAP applications on Axis devices. This issue arises from inadequate input validation within the application handling service, permitting malicious actors to execute arbitrary commands on the affected systems. Axis has acknowledged this security flaw and issued updated versions of AXIS OS to mitigate the risks. Users are strongly advised to upgrade their systems to the latest versions and consult the Axis security advisory for further details and recommended actions.

Affected Version(s)

AXIS OS AXIS OS 10.5 – 11.5

References

https://www.axis.com/dam/public/ad/ff/83/cve-2023-21413pd...

CVSS V3.1

Score:
7.2
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.