Vulnerability · Published Feb 14, 2022 · Assigned by Axis
CVE-2022-23410
High 7.8
In plain English
A high-severity uncontrolled search path in AXIS IP Utility from Axis Communications AB. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 33% of all known vulnerabilities).
Severity (CVSS NVD)7.8High
Exploit odds (30 days)0.4%top 67.4% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
AXIS IP Utility before 4.18.0 allows for remote code execution and local privilege escalation by the means of DLL hijacking. IPUtility.exe would attempt to load DLLs from its current working directory which could allow for remote code execution if a compromised DLL would be placed in the same folder.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Axis Communications AB | AXIS IP Utility | All version prior to 4.18.0 |
Weakness: CWE-427
References
- https://www.axis.com/files/tech_notes/CVE-2022-23410.pdf x_refsource_MISC