CVE-2024-8772 — Improper Validation of Syntactic Correctness of Input in Communications AB Axis OS

CWE-1286 — Improper Validation of Syntactic Correctness of Input3 documents3 sources

Severity

4.3MEDIUMNVD

EPSS

0.1%

top 77.86%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Axis Communications AB Axis OS

Timeline

PublishedNov 26

Description

51l3nc3, member of the AXIS OS Bug Bounty Program, has found that the VAPIX API managedoverlayimages.cgi was vulnerable to a race condition attack allowing for an attacker to block access to the overlay configuration page in the web interface of the Axis device. This flaw can only be exploited after authenticating with an operator- or administrator-privileged service account. Axis has released patched AXIS OS versions for the highlighted flaw. Please refer to the Axis security advisory for more …

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:LExploitability: 2.8 | Impact: 1.4

Affected Packages1 packages

▶CVEListV5axis_communications_ab/axis_os9.80.0 — 9.80.84+3

🔴Vulnerability Details

CVEList

CVE-2024-8772: 51l3nc3, member of the AXIS OS Bug Bounty Program, has found that the VAPIX API managedoverlayimages↗2024-11-26

▶

GHSA

GHSA-3v44-23hf-q5wp: 51l3nc3, member of the AXIS OS Bug Bounty Program, has found that the VAPIX API managedoverlayimages↗2024-11-26

▶