Race Condition Vulnerability in Axis Device Web Interface

CVE-2024-47262

What is CVE-2024-47262?

A race condition vulnerability in the VAPIX API param.cgi allows attackers to exploit the situation, potentially blocking access to the web interface of Axis devices. This security flaw was discovered by Dzmitry Lukyanenka as part of the AXIS OS Bug Bounty Program. It specifically affects attempts to interact with the param.cgi endpoint, while other API endpoints remain secure. Axis has issued security patches in recent AXIS OS releases, urging users to update their systems to mitigate this risk. For further details and remediation steps, refer to the Axis security advisory.

References