Lucene search

[email protected]CVE-2023-21414

HistoryOct 16, 2023 - 7:15 a.m.

CVE-2023-21414

2023-10-1607:15:08

[email protected]

web.nvd.nist.gov

ncc group

axis communications

secure boot

device tampering

penetration test

vulnerability

cve-2023-21414

nvd

axis security advisory

7.1 High

CVSS3

Attack Vector

PHYSICAL

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

6.5 Medium

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

51.6%

JSON

NCC Group has found a flaw during the annual internal penetration test ordered by Axis Communications. The protection for device tampering (commonly known as Secure Boot) contains a flaw which provides an opportunity for a sophisticated attack to bypass this protection. Axis has released patched AXIS OS versions for the highlighted flaw. Please refer to the Axis security advisory for more information and solution.

Affected configurations

NVD

Node

axisaxis_osRange10.11.55–10.12.206

axisaxis_osRange11.0.89–11.6.94active

AND

axism3215Match-

axism3216Match-

axism4317-plveMatch-

axism4318-plveMatch-

axism4327-pMatch-

axism4328-pMatch-

axisp1467-leMatch-

axisp1468-leMatch-

axisp1468-xleMatch-

axisp3265-lvMatch-

axisp3265-lveMatch-

axisp3265-vMatch-

axisp3267-lvMatch-

axisp3267-lveMatch-

axisp3268-lvMatch-

axisp3268-lveMatch-

axisp3827-pveMatch-

axisp4705-plveMatch-

axisp4707-plveMatch-

axisq1656Match-

axisq1656-bMatch-

axisq1656-beMatch-

axisq1656-bleMatch-

axisq1656-dleMatch-

axisq1656-leMatch-

axisq1961-teMatch-

axisq2101-teMatch-

axisq3536-lveMatch-

axisq3538-lveMatch-

axisq3626-veMatch-

axisq3628-veMatch-

axisxfq1656Match-

Node

axisaxis_osRange<11.6.94active

AND

axisa8207-ve_mk_iiMatch-

Node

axisaxis_osRange10.11.55–10.12.206

axisaxis_osRange11.0.89–11.6.94active

AND

axisq3527-lveMatch-

CPENameOperatorVersion
axis:axis_osaxis axis oslt10.12.206
axis:axis_osaxis axis oslt11.6.94

CPE	Name	Operator	Version
axis:axis_os	axis axis os	lt	10.12.206
axis:axis_os	axis axis os	lt	11.6.94

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "platforms": [
      "ARTPEC 8"
    ],
    "product": "AXIS OS",
    "vendor": "Axis Communications AB",
    "versions": [
      {
        "status": "affected",
        "version": "AXIS OS 10.11 - 11.5"
      }
    ]
  },
  {
    "defaultStatus": "unaffected",
    "product": "AXIS A8207-VE Mk II",
    "vendor": "Axis Communications AB",
    "versions": [
      {
        "status": "affected",
        "version": "AXIS OS 11.5 or earlier"
      }
    ]
  },
  {
    "defaultStatus": "unaffected",
    "product": "AXIS Q3527-LVE",
    "vendor": "Axis Communications AB",
    "versions": [
      {
        "status": "affected",
        "version": "AXIS OS 10.11 - 11.5"
      }
    ]
  }
]

References

www.axis.com/dam/public/45/3c/a1/cve-2023-21414pdf-en-US-412758.pdf

7.1 High

CVSS3

Attack Vector

PHYSICAL

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

6.5 Medium

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

51.6%

JSON

Related for CVE-2023-21414

prion1 cvelist1 nvd1 openvas1