AO
Product
Axis OS
38
CVEs
0
On KEV
8.8
Max CVSS
0
New 30D
Severity mix
Critical 0High 17Medium 20Low 1
Watch
Add Axis OS to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2025-5718 | 6.8 | Nov 11 | The ACAP Application framework could allow privilege escalation through a symlink attack Affected: 12.0.0 before 12.6.30 |
| CVE-2023-5553 | 6.8 | Nov 21 | During internal Axis Security Development Model (ASDM) threat-modelling, a flaw was found in the protection for device tampering (commonly known as Secure Boot) in AXIS OS making… Affected: 10.8 before 11.7.57 |
| CVE-2023-21414 | 6.8 | Oct 16 | NCC Group has found a flaw during the annual internal penetration test ordered by Axis Communications Affected: 10.11.55 before 10.12.206; 11.0.89 before 11.6.94; before 11.6.94; 10.11.55 before 10.12.206; 11.0.89 before 11.6.94 |
| CVE-2021-31986 | 6.8 | Oct 5 | User controlled parameters related to SMTP notifications are not correctly validated Affected: before 10.7 |
| CVE-2025-8108 | 6.7 | Nov 11 | An ACAP configuration file has improper permissions and lacks input validation, which could potentially lead to privilege escalation Affected: 12.0.0 before 12.7.33 |
| CVE-2025-6779 | 6.7 | Nov 11 | An ACAP configuration file has improper permissions, which could allow command injection and potentially lead to privilege escalation Affected: 12.0.0 before 12.6.40 |
| CVE-2025-6298 | 6.7 | Nov 11 | ACAP applications can gain elevated privileges due to improper input validation, potentially leading to privilege escalation Affected: before 12.6.28 |
| CVE-2025-5454 | 6.7 | Nov 11 | An ACAP configuration file lacked sufficient input validation, which could allow a path traversal attack leading to potential privilege escalation Affected: 12.0.0 before 12.6.18 |
| CVE-2025-4645 | 6.7 | Nov 11 | An ACAP configuration file lacked sufficient input validation, which could allow for arbitrary code execution Affected: 12.0.0 before 12.6.7 |
| CVE-2025-3892 | 6.7 | Aug 12 | ACAP applications can be executed with elevated privileges, potentially leading to privilege escalation Affected: 12.0.0 before 12.5.31 |
| CVE-2025-30027 | 6.7 | Aug 12 | An ACAP configuration file lacked sufficient input validation, which could allow for arbitrary code execution Affected: 12.0.0 before 12.5.36 |
| CVE-2025-5452 | 6.6 | Nov 11 | A malicious ACAP application can gain access to admin-level service account credentials used by legitimate ACAP applications, leading to potential privilege escalation of the… Affected: 12.0.0 before 12.6.69 |
| CVE-2024-0055 | 6.5 | Mar 19 | Sandro Poppi, member of the AXIS OS Bug Bounty Program, has found that the VAPIX APIs mediaclip.cgi and playclip.cgi was vulnerable for file globbing which could lead to a… Affected: 10.12.0 before 11.9.53 |
| CVE-2023-21416 | 6.5 | Nov 21 | Sandro Poppi, member of the AXIS OS Bug Bounty Program, has found that the VAPIX API dynamicoverlay.cgi was vulnerable to a Denial-of-Service attack allowing for an attacker to… Affected: before 11.7.57 |
| CVE-2023-21405 | 6.5 | Jul 25 | Knud from Fraktal.fi has found a flaw in some Axis Network Door Controllers and Axis Network Intercoms when communicating over OSDP, highlighting that the OSDP message parser… Affected: through 10.12.178; 11.0 through 11.5.53; through 10.12.178; 11.0 through 11.5.53 |
| CVE-2024-7784 | 6.1 | Sep 10 | During internal Axis Security Development Model (ASDM) threat-modelling, a flaw was found in the protection for device tampering (commonly known as Secure Boot) in AXIS OS making… Affected: 10.9 before 11.11; 10.10 before 11.11; 11.8 before 11.11; 11.11 |
| CVE-2025-0359 | 5.5 | Mar 4 | During an annual penetration test conducted on behalf of Axis Communication, Truesec discovered a flaw in the ACAP Application framework that allowed applications to access… Affected: 11.11.0 before 12.2.52 |
| CVE-2025-0361 | 5.3 | Apr 8 | During an annual penetration test conducted on behalf of Axis Communications, Truesec discovered a flaw in the VAPIX Device Configuration framework that allowed for… Affected: 11.11.0 before 12.3.56 |
| CVE-2023-21404 | 5.3 | May 8 | AXIS OS 11.0.X - 11.3.x use a static RSA key in legacy LUA-components to protect Axis-specific source code Affected: 11.0.89 before 11.4.52 |
| CVE-2024-47261 | 4.3 | Apr 8 | 51l3nc3, a member of the AXIS OS Bug Bounty Program, has found that the VAPIX API uploadoverlayimage.cgi did not have sufficient input validation to allow an attacker to upload… Affected: 10.12.0 before 12.3.56 |
Showing 20