Lucene search

[email protected]NVD:CVE-2023-21414

HistoryOct 16, 2023 - 7:15 a.m.

CVE-2023-21414

2023-10-1607:15:08

[email protected]

web.nvd.nist.gov

ncc group

flaw

penetration test

axis communications

device tampering

secure boot

protection

sophisticated attack

bypass

patched

axis os

security advisory

6.8 Medium

CVSS3

Attack Vector

PHYSICAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

6.9 Medium

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

51.9%

JSON

NCC Group has found a flaw during the annual internal penetration test ordered by Axis Communications. The protection for device tampering (commonly known as Secure Boot) contains a flaw which provides an opportunity for a sophisticated attack to bypass this protection. Axis has released patched AXIS OS versions for the highlighted flaw. Please refer to the Axis security advisory for more information and solution.

Affected configurations

NVD

Node

axisaxis_osRange10.11.55–10.12.206

axisaxis_osRange11.0.89–11.6.94active

AND

axism3215Match-

axism3216Match-

axism4317-plveMatch-

axism4318-plveMatch-

axism4327-pMatch-

axism4328-pMatch-

axisp1467-leMatch-

axisp1468-leMatch-

axisp1468-xleMatch-

axisp3265-lvMatch-

axisp3265-lveMatch-

axisp3265-vMatch-

axisp3267-lvMatch-

axisp3267-lveMatch-

axisp3268-lvMatch-

axisp3268-lveMatch-

axisp3827-pveMatch-

axisp4705-plveMatch-

axisp4707-plveMatch-

axisq1656Match-

axisq1656-bMatch-

axisq1656-beMatch-

axisq1656-bleMatch-

axisq1656-dleMatch-

axisq1656-leMatch-

axisq1961-teMatch-

axisq2101-teMatch-

axisq3536-lveMatch-

axisq3538-lveMatch-

axisq3626-veMatch-

axisq3628-veMatch-

axisxfq1656Match-

Node

axisaxis_osRange<11.6.94active

AND

axisa8207-ve_mk_iiMatch-

Node

axisaxis_osRange10.11.55–10.12.206

axisaxis_osRange11.0.89–11.6.94active

AND

axisq3527-lveMatch-

References

www.axis.com/dam/public/45/3c/a1/cve-2023-21414pdf-en-US-412758.pdf

6.8 Medium

CVSS3

Attack Vector

PHYSICAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

6.9 Medium

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

51.9%

JSON

Related for NVD:CVE-2023-21414

cvelist1 prion1 cve1 openvas1