Paper/Archive/CVE-2023-21413

CVE-2023-21413

Axis Communications AB AXIS OS — Remote code execution vulnerability during the installation of ACAP applications on the Axis device

EPSS 1%CVSS 9.1

critical.is priorityof 100

CVSS 9.1 (CNA)9.1 / 10 × 3027.3 Not in CISA KEV+300.0 EPSS percentile 73.7.737 × 2014.7 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

GoSecure on behalf of Genetec Inc. has found a flaw that allows for a remote code execution during the installation of ACAP applications on the Axis device. The application handling service in AXIS OS was vulnerable to command injection allowing an attacker to run arbitrary code. Axis has released patched AXIS OS versions for the highlighted flaw. Please refer to the Axis security advisory for more information and solution.

Affected

ProductAffectedFixed inSource

AXIS OSAXIS OS 10.5 – 11.5–CNA

axis_os10.5 – 11.5–CISA-ADP

Scores by source

Axis (CNA)9.1CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

refaxis.com/dam/public/ad/ff/83/cve-2023-21413pdf-en-US-412755.pdf