Lucene search

[email protected]CVE-2023-5677

HistoryFeb 05, 2024 - 6:15 a.m.

CVE-2023-5677

2024-02-0506:15:46

CWE-94

[email protected]

web.nvd.nist.gov

cve-2023-5677

vapix api

tcptest.cgi

remote code execution

input validation

axis

security advisory

8.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

8.6 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

21.5%

JSON

Brandon
Rothel from QED Secure Solutions has found that the VAPIX API tcptest.cgi
did not have a sufficient input validation allowing for a possible remote code
execution. This flaw can only be exploited after authenticating with an
operator- or administrator-privileged service account. The impact of exploiting
this vulnerability is lower with operator-privileges compared to
administrator-privileges service accounts. Axis has released patched AXIS OS
versions for the highlighted flaw. Please refer to the Axis security advisory
for more information and solution.

Affected configurations

NVD

Node

axism3024-lveMatch-

AND

axism3024-lve_firmwareRange<5.51.7.7

Node

axism3025-veMatch-

AND

axism3025-ve_firmwareRange<5.51.7.7

Node

axism7014Match-

AND

axism7014_firmwareRange<5.51.7.7

Node

axism7016Match-

AND

axism7016_firmwareRange<5.51.7.7

Node

axisp1214-eMatch-

AND

axisp1214-e_firmwareRange<5.51.7.7

Node

axisp7214Match-

AND

axisp7214_firmwareRange<5.51.7.7

Node

axisp7216Match-

AND

axisp7216_firmwareRange<5.51.7.7

Node

axisq7401_firmwareRange<5.51.7.7

AND

axisq7401Match-

Node

axisq7404_firmwareRange<5.51.7.7

AND

axisq7404Match-

Node

axisq7414_firmwareRange<5.51.7.7

AND

axisq7414Match-

Node

axisq7424-r_mk_ii_firmwareRange<5.51.3.9

AND

axisq7424-r_mk_iiMatch-

CPENameOperatorVersion
axis:m3024-lve_firmwareaxis m3024-lve firmwarelt5.51.7.7

CPE	Name	Operator	Version
axis:m3024-lve_firmware	axis m3024-lve firmware	lt	5.51.7.7

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "AXIS OS",
    "vendor": "Axis Communications AB",
    "versions": [
      {
        "status": "affected",
        "version": "AXIS OS 5.51"
      }
    ]
  }
]