8.8

CVE-2023-5677

Brandon
Rothel from QED Secure Solutions and Sam Hanson of Dragos have found that the VAPIX API tcptest.cgi
did not have a sufficient input validation allowing for a possible remote code
execution. This flaw can only be exploited after authenticating with an
operator- or administrator-privileged service account. The impact of exploiting
this vulnerability is lower with operator-privileges compared to
administrator-privileges service accounts. Please refer to the Axis security advisory
for more information and solution.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Axis ≫ M3024-lve Firmware Version < 5.51.7.7
   Axis ≫ M3024-lve Version -
Axis ≫ M3025-ve Firmware Version < 5.51.7.7
   Axis ≫ M3025-ve Version -
Axis ≫ M7014 Firmware Version < 5.51.7.7
   Axis ≫ M7014 Version -
Axis ≫ M7016 Firmware Version < 5.51.7.7
   Axis ≫ M7016 Version -
Axis ≫ P1214-e Firmware Version < 5.51.7.7
   Axis ≫ P1214-e Version -
Axis ≫ P7214 Firmware Version < 5.51.7.7
   Axis ≫ P7214 Version -
Axis ≫ P7216 Firmware Version < 5.51.7.7
   Axis ≫ P7216 Version -
Axis ≫ Q7401 Firmware Version < 5.51.7.7
   Axis ≫ Q7401 Version -
Axis ≫ Q7404 Firmware Version < 5.51.7.7
   Axis ≫ Q7404 Version -
Axis ≫ Q7414 Firmware Version < 5.51.7.7
   Axis ≫ Q7414 Version -
Axis ≫ Q7424-r Mk Ii Firmware Version < 5.51.3.9
   Axis ≫ Q7424-r Mk Ii Version -
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.56% 0.421
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 8.8 2.8 5.9
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
product-security@axis.com 6.3 2.8 3.4
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

CWE-94 Improper Control of Generation of Code ('Code Injection')

The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

https://www.axis.com/dam/public/a9/dd/f1/cve-2023-5677-en-US-424335.pdf
Vendor Advisory
https://www.axis.com/dam/public/0a/47/d1/cve-2023-5677-en-US-483444.pdf