Critical severity · published Jun 15, 2022
CVE-2017-20049
A vulnerability, was found in legacy Axis devices such as P3225 and M3005
9.8
CVSS
1.6%
EPSS
No
On KEV
Description
A vulnerability, was found in legacy Axis devices such as P3225 and M3005. This affects an unknown part of the component CGI Script. The manipulation leads to improper privilege management. It is possible to initiate the attack remotely.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.6% · higher than 75% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MF
M3005 Firmware · Axis
through 5.50.5.7 · source: NVD
MF
M3007 Firmware · Axis
through 6.30.1.1 · source: NVD
MF
M3045 Firmware · Axis
through 6.15.4.1 · source: NVD
PF
P1204 Firmware · Axis
through 5.50.4 · source: NVD
PF
P3225 Firmware · Axis
through 6.30.1 · source: NVD
PF
P3367 Firmware · Axis
through 6.10.1.2 · source: NVD