Axis vulnerabilities | LiveThreat CVE Feed

CVE	Product	CVSS	EPSS	Published	Summary
CVE-2026-1185	AO Axis OS Axis	8.8	0%	May 12	A configuration file on the local file system had improper input validation which could allow code execution and potentially lead to privilege escalation
CVE-2026-0804	AO Axis OS Axis	7.3	0%	May 12	An ACAP configuration file lacked sufficient input validation, which could allow a path traversal attack leading to potential privilege escalation
CVE-2026-0802	AO Axis OS Axis	7.3	0%	May 12	An ACAP configuration file lacked sufficient input validation, which could allow command injection and potentially lead to privilege escalation
CVE-2026-0541	AO Axis OS Axis	7.3	0%	May 12	ACAP applications can gain elevated privileges due to improper input validation during the installation process, potentially leading to privilege escalation
CVE-2025-12063	CS Camera Station Pro Axis	5.7	0%	Feb 10	An insecure direct object reference allowed a non-admin user to modify or remove certain data objects without having the appropriate permissions
CVE-2025-12757	CS Camera Station Pro Axis	4.6	0%	Feb 10	An AXIS Camera Station Pro feature can be exploited in a way that allows a non-admin user to view information they are not permitted to
CVE-2025-13064	CS Camera Station Pro Axis	4.5	0%	Feb 10	A server-side injection was possible for a malicious admin to manipulate the application to include a malicious script which is executed by the server
CVE-2025-11547	CS Camera Station Pro Axis	7.8	0%	Feb 10	AXIS Camera Station Pro contained a flaw to perform a privilege escalation attack on the server as a non-admin user
CVE-2025-11142	AO Axis OS Axis	8.8	1%	Feb 10	The VAPIX API mediaclip.cgi that did not have a sufficient input validation allowing for a possible remote code execution
CVE-2025-8108	AO Axis OS Axis	6.7	0%	Nov 11	An ACAP configuration file has improper permissions and lacks input validation, which could potentially lead to privilege escalation
CVE-2025-6779	AO Axis OS Axis	6.7	1%	Nov 11	An ACAP configuration file has improper permissions, which could allow command injection and potentially lead to privilege escalation
CVE-2025-6298	AO Axis OS Axis	6.7	0%	Nov 11	ACAP applications can gain elevated privileges due to improper input validation, potentially leading to privilege escalation
CVE-2025-5718	AO Axis OS Axis	6.8	0%	Nov 11	The ACAP Application framework could allow privilege escalation through a symlink attack
CVE-2025-5454	AO Axis OS Axis	6.7	0%	Nov 11	An ACAP configuration file lacked sufficient input validation, which could allow a path traversal attack leading to potential privilege escalation
CVE-2025-5452	AO Axis OS Axis	6.6	0%	Nov 11	A malicious ACAP application can gain access to admin-level service account credentials used by legitimate ACAP applications, leading to potential privilege escalation of the…
CVE-2025-4645	AO Axis OS Axis	6.7	0%	Nov 11	An ACAP configuration file lacked sufficient input validation, which could allow for arbitrary code execution
CVE-2025-3892	AO Axis OS Axis	6.7	0%	Aug 12	ACAP applications can be executed with elevated privileges, potentially leading to privilege escalation
CVE-2025-30027	AO Axis OS Axis	6.7	0%	Aug 12	An ACAP configuration file lacked sufficient input validation, which could allow for arbitrary code execution
CVE-2025-7622	CS Camera Station Axis	5.7	0%	Aug 12	During an internal security assessment, a Server-Side Request Forgery (SSRF) vulnerability that allowed an authenticated attacker to access internal resources on the server was…
CVE-2025-30026	CS Camera Station Axis	9.8	1%	Jul 11	The AXIS Camera Station Server had a flaw that allowed to bypass authentication that is normally required
CVE-2025-30025	CS Camera Station Pro Axis	7.8	0%	Jul 11	The communication protocol used between the server process and the service control had a flaw that could lead to a local privilege escalation
CVE-2025-30024	DM Device Manager Axis	6.8	0%	Jul 11	The communication protocol used between client and server had a flaw that could be leveraged to execute a man in the middle attack
CVE-2025-30023	CS Camera Station Axis	9.0	1%	Jul 11	The communication protocol used between client and server had a flaw that could lead to an authenticated user performing a remote code execution attack
CVE-2025-0358	AO Axis OS Axis	8.8	0%	Jun 2	During an annual penetration test conducted on behalf of Axis Communication, Truesec discovered a flaw in the VAPIX Device Configuration framework that allowed a privilege…
CVE-2025-0324	AO Axis OS Axis	8.8	0%	Jun 2	The VAPIX Device Configuration framework allowed a privilege escalation, enabling a lower-privileged user to gain administrator privileges
CVE-2025-1056	CS Camera Station Pro Axis	6.5	0%	Apr 23	Gee-netics, member of AXIS Camera Station Pro Bug Bounty Program, has identified an issue with a specific file that the server is using
CVE-2025-0926	CS Camera Station Pro Axis	7.3	0%	Apr 23	Gee-netics, member of AXIS Camera Station Pro Bug Bounty Program, has found that it is possible for a non-admin user to remove system files causing a boot loop by redirecting a…
CVE-2025-0361	AO Axis OS Axis	5.3	0%	Apr 8	During an annual penetration test conducted on behalf of Axis Communications, Truesec discovered a flaw in the VAPIX Device Configuration framework that allowed for…
CVE-2024-47261	AO Axis OS Axis	4.3	0%	Apr 8	51l3nc3, a member of the AXIS OS Bug Bounty Program, has found that the VAPIX API uploadoverlayimage.cgi did not have sufficient input validation to allow an attacker to upload…
CVE-2025-0360	AO Axis OS Axis	7.8	0%	Mar 4	During an annual penetration test conducted on behalf of Axis Communication, Truesec discovered a flaw in the VAPIX Device Configuration framework that could lead to an incorrect…
CVE-2025-0359	AO Axis OS Axis	5.5	0%	Mar 4	During an annual penetration test conducted on behalf of Axis Communication, Truesec discovered a flaw in the ACAP Application framework that allowed applications to access…
CVE-2024-47259	AO Axis OS Axis	7.1	1%	Mar 4	Girishunawane, member of the AXIS OS Bug Bounty Program, has found that the VAPIX API dynamicoverlay.cgi did not have a sufficient input validation allowing for a possible command…
CVE-2024-7696	CS Camera Station Pro Axis	6.3	0%	Jan 7	Seth Fogie, member of AXIS Camera Station Pro Bug Bounty Program, has found that it is possible for an authenticated malicious client to tamper with audit log creation in AXIS…
CVE-2024-8160	AO Axis OS Axis	2.7	1%	Nov 26	Erik de Jong, member of the AXIS OS Bug Bounty Program, has found that the VAPIX API ftptest.cgi did not have a sufficient input validation allowing for a possible command…
CVE-2024-7784	AO Axis OS Axis	6.1	0%	Sep 10	During internal Axis Security Development Model (ASDM) threat-modelling, a flaw was found in the protection for device tampering (commonly known as Secure Boot) in AXIS OS making…
CVE-2024-6979	AO Axis OS 2024 Axis	7.5	0%	Sep 10	Amin Aliakbari, member of the AXIS OS Bug Bounty Program, has found a broken access control which would lead to less-privileged operator- and/or viewer accounts having more…
CVE-2024-0055	AO Axis OS Axis	6.5	1%	Mar 19	Sandro Poppi, member of the AXIS OS Bug Bounty Program, has found that the VAPIX APIs mediaclip.cgi and playclip.cgi was vulnerable for file globbing which could lead to a…
CVE-2023-5800	AO Axis OS Axis	8.8	1%	Feb 5	Vintage, member of the AXIS OS Bug Bounty Program, has found that the VAPIX API create_overlay.cgi did not have a sufficient input validation allowing for a possible remote code…
CVE-2023-5677	QF Q7401 Firmware Axis	8.8	1%	Feb 5	Brandon Rothel from QED Secure Solutions and Sam Hanson of Dragos have found that the VAPIX API tcptest.cgi did not have a sufficient input validation allowing for a possible…
CVE-2023-5553	AO Axis OS Axis	6.8	0%	Nov 21	During internal Axis Security Development Model (ASDM) threat-modelling, a flaw was found in the protection for device tampering (commonly known as Secure Boot) in AXIS OS making…
CVE-2023-21418	AO Axis OS Axis	7.1	1%	Nov 21	Sandro Poppi, member of the AXIS OS Bug Bounty Program, has found that the VAPIX API irissetup.cgi was vulnerable to path traversal attacks that allows for file deletion
CVE-2023-21417	AO Axis OS Axis	7.1	1%	Nov 21	Sandro Poppi, member of the AXIS OS Bug Bounty Program, has found that the VAPIX API manageoverlayimage.cgi was vulnerable to path traversal attacks that allows for file/folder…
CVE-2023-21416	AO Axis OS Axis	6.5	1%	Nov 21	Sandro Poppi, member of the AXIS OS Bug Bounty Program, has found that the VAPIX API dynamicoverlay.cgi was vulnerable to a Denial-of-Service attack allowing for an attacker to…
CVE-2023-21415	AO Axis OS Axis	8.1	1%	Oct 16	Sandro Poppi, member of the AXIS OS Bug Bounty Program, has found that the VAPIX API overlay_del.cgi is vulnerable to path traversal attacks that allows for file deletion
CVE-2023-21414	AO Axis OS Axis	6.8	0%	Oct 16	NCC Group has found a flaw during the annual internal penetration test ordered by Axis Communications
CVE-2023-21413	AO Axis OS Axis	7.2	1%	Oct 16	GoSecure on behalf of Genetec Inc
CVE-2023-21412	LP License Plate Verifier Axis	8.8	1%	Aug 3	User provided input is not sanitized on the AXIS License Plate Verifier specific “search.cgi” allowing for SQL injections
CVE-2023-21411	LP License Plate Verifier Axis	8.8	1%	Aug 3	User provided input is not sanitized in the “Settings > Access Control” configuration interface allowing for arbitrary code execution
CVE-2023-21410	LP License Plate Verifier Axis	8.8	1%	Aug 3	User provided input is not sanitized on the AXIS License Plate Verifier specific “api.cgi” allowing for arbitrary code execution
CVE-2023-21409	LP License Plate Verifier Axis	9.8	1%	Aug 3	Due to insufficient file permissions, unprivileged users could gain access to unencrypted administrator credentials allowing the configuration of the application
CVE-2023-21408	LP License Plate Verifier Axis	9.8	1%	Aug 3	Due to insufficient file permissions, unprivileged users could gain access to unencrypted user credentials that are used in the integration interface towards 3rd party systems
CVE-2023-21407	LP License Plate Verifier Axis	8.8	1%	Aug 3	A broken access control was found allowing for privileged escalation of the operator account to gain administrator privileges
CVE-2023-21406	AF A1001 Firmware Axis	8.8	0%	Jul 25	Ariel Harush and Roy Hodir from OTORIO have found a flaw in the AXIS A1001 when communicating over OSDP
CVE-2023-21405	AF A1001 Firmware Axis	6.5	0%	Jul 25	Knud from Fraktal.fi has found a flaw in some Axis Network Door Controllers and Axis Network Intercoms when communicating over OSDP, highlighting that the OSDP message parser…
CVE-2023-21404	AO Axis OS Axis	5.3	0%	May 8	AXIS OS 11.0.X - 11.3.x use a static RSA key in legacy LUA-components to protect Axis-specific source code
CVE-2023-22984	2F 207w Firmware Axis	6.1	0%	Feb 21	A Vulnerability was discovered in Axis 207W network camera
CVE-2017-20049	PF P1204 Firmware Axis	9.8	2%	Jun 15	A vulnerability, was found in legacy Axis devices such as P3225 and M3005
CVE-2022-23410	IU IP Utility Axis	7.8	0%	Feb 14	AXIS IP Utility before 4.18.0 allows for remote code execution and local privilege escalation by the means of DLL hijacking
CVE-2021-31988	AO Axis OS Axis	8.8	1%	Oct 5	A user controlled parameter related to SMTP test functionality is not correctly validated making it possible to add the Carriage Return and Line Feed (CRLF) control characters and…
CVE-2021-31987	AO Axis OS 2016 Axis	7.5	1%	Oct 5	A user controlled parameter related to SMTP test functionality is not correctly validated making it possible to bypass blocked network recipients