CVE-2024-0055: Sandro Poppi, member of the AXIS OS Bug Bounty Program, has found that the VAPIX APIs mediaclip.cgi and playclip.cgi was vulnerable for file globbing which…

PriorityP335medium6.5CVSS 3.1

AVNACLPRLUINSUCNINAH

EPSS

0.60%

44.9th percentile

Sandro Poppi, member of the AXIS OS Bug Bounty Program, has found that the VAPIX APIs mediaclip.cgi and playclip.cgi was vulnerable for file globbing which could lead to a resource exhaustion attack. Axis has released patched AXIS OS versions for the highlighted flaw. Please refer to the Axis security advisory for more information and solution.

Affected

3 ranges

Vendor	Product	Version range	Fixed in
axis	axis_os	>= 10.12.0 < 11.9.53	11.9.53
axis	axis_os_2022	< 10.12.228	10.12.228
axis_communications_ab	axis_os	—	—

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.