Vulnerability · Published Jul 25, 2023 · Assigned by Axis
CVE-2023-21405Denial-of-Service vulnerability in Axis Network Door Controller's and Axis Network Intercom's OSDP communication
Medium 6.5
In plain English
A medium-severity security flaw in AXIS A1001 Network Door Controller from Axis Communications AB. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 22% of all known vulnerabilities).
Official description
Knud from Fraktal.fi has found a flaw in some Axis Network Door Controllers and Axis Network Intercoms when communicating over OSDP, highlighting that the OSDP message parser crashes the pacsiod process, causing a temporary unavailability of the door-controlling functionalities meaning that doors cannot be opened or closed. No sensitive or customer data can be extracted as the Axis device is not further compromised. Please refer to the Axis security advisory for more information, mitigation and affected products and software versions.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Axis Communications AB | AXIS A1001 Network Door Controller | AXIS OS 1.65.4 or earlier |
| Axis Communications AB | AXIS A1210-B Network Door Controller | AXIS OS 11.0 - 11.6.16.0 |
| Axis Communications AB | AXIS A1601 Network Door Controller | AXIS OS 1.84.4 or earlierAXIS OS 10.12.171.0 or earlierAXIS OS 11.0 - 11.6.16.0 |
| Axis Communications AB | AXIS A1610 (-B) Network Door Controller | AXIS OS 10.12.171.0 or earlierAXIS OS 11.0 - 11.6.16.0 |
| Axis Communications AB | AXIS A8207-VE Network Video Door Station | AXIS OS 10.12.178 or earlierAXIS OS AXIS OS 11.0 - 11.5.53 |
| Axis Communications AB | AXIS A8207-VE Mk II Network Video Door Station | AXIS OS 10.12.178 or earlierAXIS OS AXIS OS 11.0 - 11.5.53 |
Weakness: CWE-1286, CWE-754 · Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H