CVE-2024-0066 — Cleartext Transmission of Sensitive Info in Communications AB Axis OS

CWE-319 — Cleartext Transmission of Sensitive Info3 documents3 sources
Severity
5.3MEDIUMNVD
EPSS
0.1%
top 77.95%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Axis Communications AB Axis OS
Timeline
PublishedJun 18

Description

Johan Fagerström, member of the AXIS OS Bug Bounty Program, has found that a O3C feature may expose sensitive traffic between the client (Axis device) and (O3C) server. If O3C is not being used this flaw does not apply. Axis has released patched AXIS OS versions for the highlighted flaw. Please refer to the Axis security advisory for more information and solution.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:NExploitability: 3.9 | Impact: 1.4

Affected Packages1 packages

▶CVEListV5axis_communications_ab/axis_osAXIS OS 5.51 -11.9

🔴Vulnerability Details

2
GHSA
GHSA-j629-whpq-gxc5: Johan Fagerström, member of the AXIS OS Bug Bounty Program, has found that a O3C feature may expose sensitive traffic between the client (Axis device)↗2024-06-18
▶
CVEList
CVE-2024-0066: Johan Fagerström, member of the AXIS OS Bug Bounty Program, has found that a O3C feature may expose sensitive traffic between the client (Axis device)↗2024-06-18
▶
CVE-2024-0066 — Communications AB Axis OS vulnerability | cvebase