Vulnerabilidades do Axis Axis Os

CVE-2026-1185 Alta · 8.8 CWE-732 12/05/2026

Incorrect Permission Assignment for Critical Resource em Axis Axis Os

A configuration file on the local file system had improper input validation which could allow code execution and potentially lead to privilege escalation. This vulnerability can only be exploited if an attacker can log in to the Axis device using SSH.

CVE-2026-0804 Alta · 7.3 CWE-35 12/05/2026

An ACAP configuration file lacked sufficient input validation, which could allow a path…

An ACAP configuration file lacked sufficient input validation, which could allow a path traversal attack leading to potential privilege escalation. This vulnerability can only be exploited if the Axis device is configured to allow the installation of unsigned ACAP applications, and if an attacker convinces the victim to install a malicious ACAP application.

CVE-2026-0802 Alta · 7.3 CWE-1287 12/05/2026

An ACAP configuration file lacked sufficient input validation, which could allow command…

An ACAP configuration file lacked sufficient input validation, which could allow command injection and potentially lead to privilege escalation. This vulnerability can only be exploited if the Axis device is configured to allow the installation of unsigned ACAP applications, and if an attacker convinces the victim to install a malicious ACAP application.

CVE-2026-0541 Alta · 7.3 CWE-732 12/05/2026

Incorrect Permission Assignment for Critical Resource em Axis Axis Os

ACAP applications can gain elevated privileges due to improper input validation during the installation process, potentially leading to privilege escalation. This vulnerability can only be exploited if the Axis device is configured to allow the installation of unsigned ACAP applications, and if an attacker convinces the victim to install a malicious ACAP application.

CVE-2025-11142 Alta · 8.8 CWE-78 10/02/2026

OS Command Injection em Axis Axis Os

The VAPIX API mediaclip.cgi that did not have a sufficient input validation allowing for a possible remote code execution. This flaw can only be exploited after authenticating with an operator- or administrator- privileged service account.

CVE-2025-8108 Média · 6.7 CWE-732 11/11/2025

Incorrect Permission Assignment for Critical Resource em Axis Axis Os

An ACAP configuration file has improper permissions and lacks input validation, which could potentially lead to privilege escalation. This vulnerability can only be exploited if the Axis device is configured to allow the installation of unsigned ACAP applications, and if an attacker convinces the victim to install a malicious ACAP application.

CVE-2025-6779 Média · 6.7 CWE-732 11/11/2025

Incorrect Permission Assignment for Critical Resource em Axis Axis Os

An ACAP configuration file has improper permissions, which could allow command injection and potentially lead to privilege escalation. This vulnerability can only be exploited if the Axis device is configured to allow the installation of unsigned ACAP applications, and if an attacker convinces the victim to install a malicious ACAP application.

CVE-2025-6298 Média · 6.7 CWE-1287 11/11/2025

ACAP applications can gain elevated privileges due to improper input validation…

ACAP applications can gain elevated privileges due to improper input validation, potentially leading to privilege escalation. This vulnerability can only be exploited if the Axis device is configured to allow the installation of unsigned ACAP applications, and if an attacker convinces the victim to install a malicious ACAP application.

CVE-2025-5718 Média · 6.8 CWE-59 11/11/2025

Link Following em Axis Axis Os

The ACAP Application framework could allow privilege escalation through a symlink attack. This vulnerability can only be exploited if the Axis device is configured to allow the installation of unsigned ACAP applications, and if an attacker convinces the victim to install a malicious ACAP application.

CVE-2025-5452 Média · 6.6 CWE-214 11/11/2025

A malicious ACAP application can gain access to admin-level service account credentials…

A malicious ACAP application can gain access to admin-level service account credentials used by legitimate ACAP applications, leading to potential privilege escalation of the malicious ACAP application. This vulnerability can only be exploited if the Axis device is configured to allow the installation of unsigned ACAP applications, and if an attacker convinces the victim to install a malicious ACAP application.

CVE-2025-5454 Média · 6.7 CWE-35 11/11/2025

An ACAP configuration file lacked sufficient input validation, which could allow a path…

An ACAP configuration file lacked sufficient input validation, which could allow a path traversal attack leading to potential privilege escalation. This vulnerability can only be exploited if the Axis device is configured to allow the installation of unsigned ACAP applications, and if an attacker convinces the victim to install a malicious ACAP application.

CVE-2025-4645 Média · 6.7 CWE-1287 11/11/2025

An ACAP configuration file lacked sufficient input validation, which could allow for…

An ACAP configuration file lacked sufficient input validation, which could allow for arbitrary code execution. This vulnerability can only be exploited if the Axis device is configured to allow the installation of unsigned ACAP applications, and if an attacker convinces the victim to install a malicious ACAP application.