CVEvulnerability
CVE-2023-5677
8.8 HIGH
Official page ↗
- Status
- Modified
- Published
- 2024-02-05
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 6.3 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
- CVSS 3.1 ([email protected])
- 8.8 HIGH — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Weaknesses
- CWE-78, CWE-94
Description
Brandon
Rothel from QED Secure Solutions and Sam Hanson of Dragos have found that the VAPIX API tcptest.cgi
did not have a sufficient input validation allowing for a possible remote code
execution. This flaw can only be exploited after authenticating with an
operator- or administrator-privileged service account. The impact of exploiting
this vulnerability is lower with operator-privileges compared to
administrator-privileges service accounts. Please refer to the Axis security advisory
for more information and solution.
Affected configurations
• axis m3024-lve firmware (< 5.51.7.7)
• axis m3025-ve firmware (< 5.51.7.7)
• axis m7014 firmware (< 5.51.7.7)
• axis m7016 firmware (< 5.51.7.7)
• axis p1214-e firmware (< 5.51.7.7)
• axis p7214 firmware (< 5.51.7.7)
• axis p7216 firmware (< 5.51.7.7)
• axis q7401 firmware (< 5.51.7.7)
• axis q7404 firmware (< 5.51.7.7)
• axis q7414 firmware (< 5.51.7.7)
• axis q7424-r mk ii firmware (< 5.51.3.9)