Vulnerability · Published Oct 16, 2023 · Assigned by Axis
CVE-2023-21413Remote code execution vulnerability during the installation of ACAP applications on the Axis device
Critical 9.1
In plain English
A critical-severity OS command injection in AXIS OS from Axis Communications AB. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.5% (higher than 74% of all known vulnerabilities).
Official description
GoSecure on behalf of Genetec Inc. has found a flaw that allows for a remote code execution during the installation of ACAP applications on the Axis device. The application handling service in AXIS OS was vulnerable to command injection allowing an attacker to run arbitrary code. Axis has released patched AXIS OS versions for the highlighted flaw. Please refer to the Axis security advisory for more information and solution.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Axis Communications AB | AXIS OS | AXIS OS 10.5 – 11.5 |
Weakness: CWE-78 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H