CVE-2023-21413 — OS Command Injection in OS

CWE-78 — OS Command InjectionCWE-77 — Command Injection4 documents4 sources
Severity
7.2HIGHNVD
CNA9.1
EPSS
0.7%
top 28.06%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Axis OSAxis Communications AB Axis OS
Timeline
PublishedOct 16

Description

GoSecure on behalf of Genetec Inc. has found a flaw that allows for a remote code execution during the installation of ACAP applications on the Axis device. The application handling service in AXIS OS was vulnerable to command injection allowing an attacker to run arbitrary code. Axis has released patched AXIS OS versions for the highlighted flaw. Please refer to the Axis security advisory for more information and solution.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:HExploitability: 1.2 | Impact: 5.9

Affected Packages2 packages

▶NVDaxis/axis_os10.5.0 — 10.12.199+1
▶CVEListV5axis_communications_ab/axis_osAXIS OS 10.5 – 11.5

🔴Vulnerability Details

2
CVEList
Remote code execution vulnerability during the installation of ACAP applications on the Axis device↗2023-10-16
▶
GHSA
GHSA-8hhq-vrcj-6mpj: GoSecure on behalf of Genetec Inc↗2023-10-16
▶
CVE-2023-21413 — OS Command Injection in Axis OS | cvebase