CVE-2024-6173 — Improper Validation of Syntactic Correctness of Input in Communications AB Axis OS

CWE-1286 — Improper Validation of Syntactic Correctness of Input3 documents3 sources

Severity

6.5MEDIUMNVD

EPSS

0.1%

top 68.01%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Axis Communications AB Axis OS

Timeline

PublishedSep 10

Description

51l3nc3, member of the AXIS OS Bug Bounty Program, has found that a Guard Tour VAPIX API parameter allowed the use of arbitrary values allowing for an attacker to block access to the guard tour configuration page in the web interface of the Axis device. Axis has released patched AXIS OS versions for the highlighted flaw. Please refer to the Axis security advisory for more information and solution.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HExploitability: 2.8 | Impact: 3.6

Affected Packages1 packages

▶CVEListV5axis_communications_ab/axis_os6.50 - 11.10

🔴Vulnerability Details

GHSA

GHSA-288p-75q5-6gj7: 51l3nc3, member of the AXIS OS Bug Bounty Program, has found that a Guard Tour VAPIX API parameter allowed the use of arbitrary values allowing for an↗2024-09-10

▶

CVEList

CVE-2024-6173: 51l3nc3, member of the AXIS OS Bug Bounty Program, has found that a Guard Tour VAPIX API parameter allowed the use of arbitrary values allowing for an↗2024-09-10

▶