CVE-2024-8160

Summary

Erik de Jong, member of the AXIS OS Bug Bounty Program, has found that the VAPIX API ftptest.cgi did not have a sufficient input validation allowing for a possible command injection leading to being able to transfer files from/to the Axis device. This flaw can only be exploited after authenticating with an administrator-privileged service account. Axis has released patched AXIS OS versions for the highlighted flaw. Please refer to the Axis security advisory for more information and solution.

Affected Software

VendorProductVersion RangeStatus
Axis Communications ABAXIS OS10.9.0 < 10.12.257affected
Axis Communications ABAXIS OS11.0.0 < 11.11.116unaffected
Axis Communications ABAXIS OS12.0.0 < 12.1.21affected

Weaknesses

  • CWE-1286: CWE-1286: Improper Validation of Syntactic Correctness of Input

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: no
    • Technical Impact: partial

References