CVE-2024-6509 — Improper Neutralization of Wildcards or Matching Symbols in Communications AB Axis OS

CWE-155 — Improper Neutralization of Wildcards or Matching Symbols CWE-770 — Allocation of Resources Without Limits or Throttling3 documents3 sources

Severity

6.5MEDIUMNVD

EPSS

0.1%

top 68.01%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Axis Communications AB Axis OS

Timeline

PublishedSep 10

Description

Marinus Pfund, member of the AXIS OS Bug Bounty Program, has found the VAPIX API alwaysmulti.cgi was vulnerable for file globbing which could lead to resource exhaustion of the Axis device. Axis has released patched AXIS OS versions for the highlighted flaw. Please refer to the Axis security advisory for more information and solution.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HExploitability: 2.8 | Impact: 3.6

Affected Packages1 packages

▶CVEListV5axis_communications_ab/axis_os6.50.0 — 6.50.5.19+4

🔴Vulnerability Details

CVEList

CVE-2024-6509: Marinus Pfund, member of the AXIS OS Bug Bounty Program, has found the VAPIX API alwaysmulti↗2024-09-10

▶

GHSA

GHSA-ccrr-hx7g-hmm4: Marinus Pfund, member of the AXIS OS Bug Bounty Program, has found the VAPIX API alwaysmulti↗2024-09-10

▶