CVE-2023-21414

published 2023-10-16

CVE-2023-21414: NCC Group has found a flaw during the annual internal penetration test ordered by Axis Communications. The protection for device tampering (commonly known as…

Priority P4 29 medium 6.8 CVSS 3.1

AV P AC L PR N UI N S U C H I H A H

NCC Group has found a flaw during the annual internal penetration test ordered by Axis Communications. The protection for device tampering (commonly known as Secure Boot) contains a flaw which provides an opportunity for a sophisticated attack to bypass this protection. Axis has released patched AXIS OS versions for the highlighted flaw. Please refer to the Axis security advisory for more information and solution.

Affected

6 ranges

Vendor	Product	Version range	Fixed in
axis	axis_os	< 11.6.94	11.6.94
axis	axis_os	>= 10.11.55 < 10.12.206	10.12.206
axis	axis_os	>= 11.0.89 < 11.6.94	11.6.94
axis_communications_ab	axis_a8207-ve_mk_ii	—	—
axis_communications_ab	axis_os	—	—
axis_communications_ab	axis_q3527-lve	—	—

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-121