Command Injection Vulnerability in AXIS OS VAPIX API by Axis Communications

CVE-2024-47259

What is CVE-2024-47259?

A command injection vulnerability exists in the VAPIX API's dynamicoverlay.cgi, identified by a lack of adequate input validation. This flaw can potentially allow an attacker to execute unauthorized commands and transfer files to the Axis device, ultimately overwhelming its system resources. Axis Communications has addressed this vulnerability in recent updates to AXIS OS, and users are urged to upgrade to the patched versions. For more detailed information, refer to the Axis security advisory.

References