AO
Product
Axis OS
38
CVEs
0
On KEV
8.8
Max CVSS
0
New 30D
Severity mix
Critical 0High 17Medium 20Low 1
Watch
Add Axis OS to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-1185 | 8.8 | May 12 | A configuration file on the local file system had improper input validation which could allow code execution and potentially lead to privilege escalation Affected: 12.0.0 before 12.10.37 |
| CVE-2025-11142 | 8.8 | Feb 10 | The VAPIX API mediaclip.cgi that did not have a sufficient input validation allowing for a possible remote code execution Affected: 12.6.54 before 12.7.36 |
| CVE-2025-0358 | 8.8 | Jun 2 | During an annual penetration test conducted on behalf of Axis Communication, Truesec discovered a flaw in the VAPIX Device Configuration framework that allowed a privilege… Affected: 12.0.0 before 12.4.0 |
| CVE-2025-0324 | 8.8 | Jun 2 | The VAPIX Device Configuration framework allowed a privilege escalation, enabling a lower-privileged user to gain administrator privileges Affected: 12.0.0 before 12.3.33 |
| CVE-2023-5800 | 8.8 | Feb 5 | Vintage, member of the AXIS OS Bug Bounty Program, has found that the VAPIX API create_overlay.cgi did not have a sufficient input validation allowing for a possible remote code… Affected: before 11.8.61 |
| CVE-2021-31988 | 8.8 | Oct 5 | A user controlled parameter related to SMTP test functionality is not correctly validated making it possible to add the Carriage Return and Line Feed (CRLF) control characters and… Affected: before 10.7 |
| CVE-2023-21415 | 8.1 | Oct 16 | Sandro Poppi, member of the AXIS OS Bug Bounty Program, has found that the VAPIX API overlay_del.cgi is vulnerable to path traversal attacks that allows for file deletion Affected: 6.50.5.3 before 6.50.5.14; 11.0.81 before 11.6.94 |
| CVE-2025-0360 | 7.8 | Mar 4 | During an annual penetration test conducted on behalf of Axis Communication, Truesec discovered a flaw in the VAPIX Device Configuration framework that could lead to an incorrect… Affected: 11.11.0 before 12.2.41 |
| CVE-2024-6979 | 7.5 | Sep 10 | Amin Aliakbari, member of the AXIS OS Bug Bounty Program, has found a broken access control which would lead to less-privileged operator- and/or viewer accounts having more… Affected: 11.11 |
| CVE-2021-31987 | 7.5 | Oct 5 | A user controlled parameter related to SMTP test functionality is not correctly validated making it possible to bypass blocked network recipients Affected: before 10.8 |
| CVE-2026-0804 | 7.3 | May 12 | An ACAP configuration file lacked sufficient input validation, which could allow a path traversal attack leading to potential privilege escalation Affected: 12.0.0 before 12.10.4 |
| CVE-2026-0802 | 7.3 | May 12 | An ACAP configuration file lacked sufficient input validation, which could allow command injection and potentially lead to privilege escalation Affected: 12.0.0 before 12.9.33 |
| CVE-2026-0541 | 7.3 | May 12 | ACAP applications can gain elevated privileges due to improper input validation during the installation process, potentially leading to privilege escalation Affected: 12.0.0 before 12.9.32 |
| CVE-2023-21413 | 7.2 | Oct 16 | GoSecure on behalf of Genetec Inc Affected: 10.5.0 before 10.12.199; 11.0.89 before 11.6.94 |
| CVE-2024-47259 | 7.1 | Mar 4 | Girishunawane, member of the AXIS OS Bug Bounty Program, has found that the VAPIX API dynamicoverlay.cgi did not have a sufficient input validation allowing for a possible command… Affected: 11.11.0 before 12.2.52 |
| CVE-2023-21418 | 7.1 | Nov 21 | Sandro Poppi, member of the AXIS OS Bug Bounty Program, has found that the VAPIX API irissetup.cgi was vulnerable to path traversal attacks that allows for file deletion Affected: before 6.50.5.15; before 11.7.57 |
| CVE-2023-21417 | 7.1 | Nov 21 | Sandro Poppi, member of the AXIS OS Bug Bounty Program, has found that the VAPIX API manageoverlayimage.cgi was vulnerable to path traversal attacks that allows for file/folder… Affected: before 11.7.57 |
Showing 17