Path Traversal Vulnerability in AXIS OS VAPIX API

CVE-2023-21418

What is CVE-2023-21418?

The VAPIX API in AXIS OS is susceptible to a path traversal vulnerability that could enable authenticated adversaries with operator or administrator privileges to delete files on the system. This security flaw, identified by researchers from the AXIS OS Bug Bounty Program, primarily impacts files that are not critical to system operations, especially when exploiting via operator-level accounts. Axis has issued patches for the affected versions, underscoring the importance of keeping systems updated to mitigate potential security risks. For further details, consult the Axis security advisory.

References