AO
Product
AXIS OS
14
CVEs
0
On KEV
8.8
Max CVSS
0
New 30D
Severity mix
Critical 0High 6Medium 8Low 0
Watch
Add AXIS OS to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-1185 | 8.8 | May 12 | A configuration file on the local file system had improper input validation which could allow code execution and potentially lead to privilege escalation Affected: 12.0.0 before 12.10.36 |
| CVE-2024-6979 | 7.5 | Sep 10 | Amin Aliakbari, member of the AXIS OS Bug Bounty Program, has found a broken access control which would lead to less-privileged operator- and/or viewer accounts having more… Affected: 11.11.0 before 11.11.94 |
| CVE-2026-0804 | 7.3 | May 12 | An ACAP configuration file lacked sufficient input validation, which could allow a path traversal attack leading to potential privilege escalation Affected: 12.0.0 before 12.10.4 |
| CVE-2026-0802 | 7.3 | May 12 | An ACAP configuration file lacked sufficient input validation, which could allow command injection and potentially lead to privilege escalation Affected: 12.0.0 before 12.9.33 |
| CVE-2026-0541 | 7.3 | May 12 | ACAP applications can gain elevated privileges due to improper input validation during the installation process, potentially leading to privilege escalation Affected: 12.0.0 before 12.9.32 |
| CVE-2026-4757 | 7.2 | Aug 11 | A VAPIX API parameter had improper input validation which could allow code execution and potentially lead to a privilege escalation Affected: 12.0.0 before 12.11.44 |
| CVE-2024-6173 | 6.5 | Sep 10 | 51l3nc3, member of the AXIS OS Bug Bounty Program, has found that a Guard Tour VAPIX API parameter allowed the use of arbitrary values allowing for an attacker to block access to… Affected: 6.50 - 11.10 |
| CVE-2024-6509 | 6.5 | Sep 10 | Marinus Pfund, member of the AXIS OS Bug Bounty Program, has found the VAPIX API alwaysmulti.cgi was vulnerable for file globbing which could lead to resource exhaustion of the… Affected: 6.50.0 before 6.50.5.19; 7.0.0 before 8.40.59; 9.0.0 before 9.80.78; 10.0.0 before 10.12.249; 11.0.0 before 11.11.93 |
| CVE-2024-7784 | 6.1 | Sep 10 | During internal Axis Security Development Model (ASDM) threat-modelling, a flaw was found in the protection for device tampering (commonly known as Secure Boot) in AXIS OS making… Affected: 10.9.0 before 10.12.246; 11.0.0 before 11.11.80; 12.0.0 before 12.0.40; 11.11.0 before 11.11.80; 12.0.0 before 12.0.47; 10.10.0 before 10.12.247; +4 more |
| CVE-2026-6181 | 5.9 | Aug 11 | The Device Configuration Framework is vulnerable to an authentication bypass flaw Affected: 12.0.0 before 12.11.13; 11.11.0 before 11.11.207 |
| CVE-2026-5304 | 5.7 | Aug 11 | An ACAP configuration file lacks input validation, which could potentially lead to privilege escalation Affected: 12.0.0 before 12.11.12 |
| CVE-2026-5303 | 5.7 | Aug 11 | The ACAP framework contains a Time-of-Check to Time-of-Use (TOCTOU) race condition, which could potentially lead to privilege escalation Affected: 12.0.0 before 12.11.31 |
| CVE-2026-6505 | 5.1 | Aug 11 | The ACAP framework contains a Time-of-Check to Time-of-Use (TOCTOU) race condition, which could potentially lead to privilege escalation Affected: 12.0.0 before 12.11.44 |
| CVE-2024-0067 | 4.3 | Sep 10 | Marinus Pfund, member of the AXIS OS Bug Bounty Program, has found the VAPIX API ledlimit.cgi was vulnerable for path traversal attacks allowing to list folder/file names on the… Affected: 8.40 - 11.10 |
Showing 14