Input Validation Flaw in VAPIX API of Axis Devices
CVE-2024-47261

4.3MEDIUM

Key Information:

Vendor

Axis Communications Ab

Status
Axis Os
Vendor
CVE Published:
8 April 2025

What is CVE-2024-47261?

A security flaw has been identified in the VAPIX API of Axis devices, specifically in the uploadoverlayimage.cgi function. This vulnerability arises due to insufficient input validation, allowing unauthorized file uploads. Consequently, an attacker could exploit this weakness to interfere with the image overlay creation process in the web interface of the affected Axis devices. Users are advised to review and enhance their security measures surrounding this API to mitigate potential risks.

Affected Version(s)

AXIS OS 10.12.0 < 10.12.276

AXIS OS 11.0.0 < 11.11.141

AXIS OS 12.0.0 < 12.3.56

References

https://www.axis.com/dam/public/18/c5/b2/cve-2024-47261pd...

CVSS V3.1

Score:
4.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.