VAPIX API Vulnerability in Axis Devices
CVE-2024-47260

6.5MEDIUM

Key Information:

Vendor

Axis Communications Ab

Status
Axis Os
Vendor
CVE Published:
4 March 2025

What is CVE-2024-47260?

An issue was identified in the VAPIX API on Axis devices, where insufficient input validation allowed users to upload more audio clips than the system was designed to handle. This flaw can lead to excessive memory usage, potentially resulting in device performance issues. Axis has addressed this vulnerability with an update, providing patched versions of AXIS OS to mitigate the risk. Users are encouraged to review the Axis security advisory for detailed information on the update.

Affected Version(s)

AXIS OS 9.80.0 < 9.80.89

AXIS OS 10.0.0 < 10.12.270

AXIS OS 11.0.0 < 11.11.135

References

https://www.axis.com/dam/public/1d/d3/ef/cve-2024-47260pd...

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.