Axis Axis Os vulnerabilities
🔔 Create alert RSS Version checker
Published CVEs affecting Axis Axis Os: 12 record(s), with affected versions and fixes.cpe:2.3:o:axis:axis_os
CVE-2026-1185
High · 8.8
CWE-732 May 12, 2026
Incorrect Permission Assignment for Critical Resource in Axis Axis Os
A configuration file on the local file system had improper input validation which could allow code execution and potentially lead to privilege escalation. This vulnerability can only be exploited if an attacker can log in to the Axis device using SSH.
CVE-2026-0804
High · 7.3
CWE-35 May 12, 2026
An ACAP configuration file lacked sufficient input validation, which could allow a path…
An ACAP configuration file lacked sufficient input validation, which could allow a path traversal attack leading to potential privilege escalation. This vulnerability can only be exploited if the Axis device is configured to allow the installation of unsigned ACAP applications, and if an attacker convinces the victim to install a malicious ACAP application.
CVE-2026-0802
High · 7.3
CWE-1287 May 12, 2026
An ACAP configuration file lacked sufficient input validation, which could allow command…
An ACAP configuration file lacked sufficient input validation, which could allow command injection and potentially lead to privilege escalation. This vulnerability can only be exploited if the Axis device is configured to allow the installation of unsigned ACAP applications, and if an attacker convinces the victim to install a malicious ACAP application.
CVE-2026-0541
High · 7.3
CWE-732 May 12, 2026
Incorrect Permission Assignment for Critical Resource in Axis Axis Os
ACAP applications can gain elevated privileges due to improper input validation during the installation process, potentially leading to privilege escalation. This vulnerability can only be exploited if the Axis device is configured to allow the installation of unsigned ACAP applications, and if an attacker convinces the victim to install a malicious ACAP application.
CVE-2025-11142
High · 8.8
CWE-78 Feb 10, 2026
OS Command Injection in Axis Axis Os
The VAPIX API mediaclip.cgi that did not have a sufficient input validation allowing for a possible remote code execution. This flaw can only be exploited after authenticating with an operator- or administrator- privileged service account.
CVE-2025-8108
Medium · 6.7
CWE-732 Nov 11, 2025
Incorrect Permission Assignment for Critical Resource in Axis Axis Os
An ACAP configuration file has improper permissions and lacks input validation, which could potentially lead to privilege escalation. This vulnerability can only be exploited if the Axis device is configured to allow the installation of unsigned ACAP applications, and if an attacker convinces the victim to install a malicious ACAP application.
CVE-2025-6779
Medium · 6.7
CWE-732 Nov 11, 2025
Incorrect Permission Assignment for Critical Resource in Axis Axis Os
An ACAP configuration file has improper permissions, which could allow command injection and potentially lead to privilege escalation. This vulnerability can only be exploited if the Axis device is configured to allow the installation of unsigned ACAP applications, and if an attacker convinces the victim to install a malicious ACAP application.
CVE-2025-6298
Medium · 6.7
CWE-1287 Nov 11, 2025
ACAP applications can gain elevated privileges due to improper input validation…
ACAP applications can gain elevated privileges due to improper input validation, potentially leading to privilege escalation. This vulnerability can only be exploited if the Axis device is configured to allow the installation of unsigned ACAP applications, and if an attacker convinces the victim to install a malicious ACAP application.
CVE-2025-5718
Medium · 6.8
CWE-59 Nov 11, 2025
Link Following in Axis Axis Os
The ACAP Application framework could allow privilege escalation through a symlink attack. This vulnerability can only be exploited if the Axis device is configured to allow the installation of unsigned ACAP applications, and if an attacker convinces the victim to install a malicious ACAP application.
CVE-2025-5452
Medium · 6.6
CWE-214 Nov 11, 2025
A malicious ACAP application can gain access to admin-level service account credentials…
A malicious ACAP application can gain access to admin-level service account credentials used by legitimate ACAP applications, leading to potential privilege escalation of the malicious ACAP application. This vulnerability can only be exploited if the Axis device is configured to allow the installation of unsigned ACAP applications, and if an attacker convinces the victim to install a malicious ACAP application.
CVE-2025-5454
Medium · 6.7
CWE-35 Nov 11, 2025
An ACAP configuration file lacked sufficient input validation, which could allow a path…
An ACAP configuration file lacked sufficient input validation, which could allow a path traversal attack leading to potential privilege escalation. This vulnerability can only be exploited if the Axis device is configured to allow the installation of unsigned ACAP applications, and if an attacker convinces the victim to install a malicious ACAP application.
CVE-2025-4645
Medium · 6.7
CWE-1287 Nov 11, 2025
An ACAP configuration file lacked sufficient input validation, which could allow for…
An ACAP configuration file lacked sufficient input validation, which could allow for arbitrary code execution. This vulnerability can only be exploited if the Axis device is configured to allow the installation of unsigned ACAP applications, and if an attacker convinces the victim to install a malicious ACAP application.