Non-Admin User Can Gain System Privileges Through File Deletion upon Service Restart

CVE-2024-6476

4.2MEDIUM

Key Information

Vendor: Axis Communications Ab
Status: Axis Camera Station Pro; Axis Camera Station
Vendor: CVE Published:; 26 November 2024

Summary

Gee-netics, member of the AXIS Camera Station Pro Bug Bounty Program has found that it is possible for a non-admin user to gain system privileges by redirecting a file deletion upon service restart. Axis has released patched versions for the highlighted flaw. Please refer to the Axis security advisory for more information and solution.

Affected Version(s)

AXIS Camera Station Pro = <6.4

AXIS Camera Station = <5.57.33556

CVSS V3.1

Score:

4.2

Severity:

MEDIUM

Confidentiality:

None

Integrity:

Low

Availability:

Low

Attack Vector:

Local

Attack Complexity:

High

Privileges Required:

Low

User Interaction:

None

Scope:

Changed

Timeline

Vulnerability published.
Nov 26, 2024
Vulnerability Reserved.
Jul 3, 2024

Collectors

NVD DatabaseMitre Database