AXIS OS at a glance
Show as table
| Month | Vulnerabilities | Critical |
|---|---|---|
| Nov 2026 | 5 | 0 |
| Oct 2026 | 0 | 0 |
| Sep 2026 | 0 | 0 |
| Aug 2026 | 5 | 0 |
| Jul 2026 | 0 | 0 |
| Jun 2026 | 0 | 0 |
| May 2026 | 4 | 0 |
| Apr 2026 | 0 | 0 |
| Mar 2026 | 0 | 0 |
| Feb 2026 | 1 | 0 |
| Jan 2026 | 0 | 0 |
| Dec 2025 | 0 | 0 |
| Nov 2025 | 11 | 0 |
| Oct 2025 | 0 | 0 |
| Sep 2025 | 0 | 0 |
| Aug 2025 | 2 | 0 |
| Jul 2025 | 0 | 0 |
| Jun 2025 | 3 | 1 |
| May 2025 | 0 | 0 |
| Apr 2025 | 2 | 0 |
| Mar 2025 | 5 | 0 |
| Feb 2025 | 0 | 0 |
| Jan 2025 | 0 | 0 |
| Dec 2024 | 0 | 0 |
61 results · Feed
-
Medium 6.5
Improper shell quote escaping when processing user-controlled input, potentially allowing command injection, which coul…
-
Low 3.9
The VAPIX Edge storage API, enabling the escalation of user privileges by circumventing filesystem isolation, granting …
-
Medium 6.7
The VAPIX SIP configuration API lacked sufficient input validation, which could potentially lead to privilege escalatio…
-
Medium 4.3
The VAPIX API dynamicoverlay.cgi which results in a Denial-of-Service of the overlay functionality. This flaw can only …
-
Medium 6.7
A locally authenticated user can achieve privilege escalation via an insecure configuration that leads to unauthorized …
-
High 7.2
A VAPIX API parameter had improper input validation which could allow code execution and potentially lead to a privileg…
-
Medium 5.1
The ACAP framework contains a Time-of-Check to Time-of-Use (TOCTOU) race condition, which could potentially lead to pri…
-
Medium 5.7
An ACAP configuration file lacks input validation, which could potentially lead to privilege escalation. This vulnerabi…
-
Medium 5.7
The ACAP framework contains a Time-of-Check to Time-of-Use (TOCTOU) race condition, which could potentially lead to pri…
-
Medium 5.9
The Device Configuration Framework is vulnerable to an authentication bypass flaw. This flaw can only be exploited afte…
-
Medium 5.4
A configuration file on the local file system had improper input validation which could allow code execution and potent…
-
Medium 6.7
An ACAP configuration file lacked sufficient input validation, which could allow a path traversal attack leading to pot…
-
Medium 6.0
An ACAP configuration file lacked sufficient input validation, which could allow command injection and potentially lead…
-
Medium 6.7
ACAP applications can gain elevated privileges due to improper input validation during the installation process, potent…
-
High 7.1CVE-2025-11142 Public exploit
The VAPIX API mediaclip.cgi that did not have a sufficient input validation allowing for a possible remote code executi…
-
Medium 6.4
The VAPIX Edge storage API that allowed a privilege escalation, enabling a VAPIX administrator-privileged user to gain …
-
Low 3.1
It was possible to upload files with a specific name to a temporary directory, which may result in process crashes and …
-
Medium 4.3
The VAPIX API port.cgi did not have sufficient input validation, which may result in process crashes and impact usabili…
-
Medium 6.7
An ACAP configuration file has improper permissions and lacks input validation, which could potentially lead to privile…
-
Medium 6.7
An ACAP configuration file has improper permissions, which could allow command injection and potentially lead to privil…
-
Medium 6.0
A 3rd-party component exposed its password in process arguments, allowing for low-privileged users to access it.
-
Medium 6.6
A malicious ACAP application can gain access to admin-level service account credentials used by legitimate ACAP applica…
-
Medium 6.7
ACAP applications can gain elevated privileges due to improper input validation, potentially leading to privilege escal…
-
Medium 6.8
The ACAP Application framework could allow privilege escalation through a symlink attack. This vulnerability can only b…
-
Medium 6.4
An ACAP configuration file lacked sufficient input validation, which could allow a path traversal attack leading to pot…
-
Medium 6.7
An ACAP configuration file lacked sufficient input validation, which could allow for arbitrary code execution. This vul…
-
Medium 6.7
An ACAP configuration file lacked sufficient input validation, which could allow for arbitrary code execution. This vul…
-
Medium 6.7
ACAP applications can be executed with elevated privileges, potentially leading to privilege escalation. This vulnerabi…
-
High 8.8
During an annual penetration test conducted on behalf of Axis Communication, Truesec discovered a flaw in the VAPIX Dev…
-
Medium 4.3
A Guard Tour VAPIX API parameter allowed the use of arbitrary values and can be incorrectly called, allowing an attacke…
-
Critical 9.4CVE-2025-0324 Public exploit
The VAPIX Device Configuration framework allowed a privilege escalation, enabling a lower-privileged user to gain admin…
-
Medium 4.3
During an annual penetration test conducted on behalf of Axis Communications, Truesec discovered a flaw in the VAPIX De…
-
Medium 4.3
51l3nc3, a member of the AXIS OS Bug Bounty Program, has found that the VAPIX API uploadoverlayimage.cgi did not have s…
-
High 7.8
During an annual penetration test conducted on behalf of Axis Communication, Truesec discovered a flaw in the VAPIX Dev…
-
High 8.5
During an annual penetration test conducted on behalf of Axis Communication, Truesec discovered a flaw in the ACAP Appl…
-
Medium 5.3
Dzmitry Lukyanenka, member of the AXIS OS Bug Bounty Program, has found that the VAPIX API param.cgi was vulnerable to …
-
Medium 6.5
51l3nc3, member of the AXIS OS Bug Bounty Program, has found that the VAPIX API mediaclip.cgi did not have a sufficient…
-
Low 3.5
Girishunawane, member of the AXIS OS Bug Bounty Program, has found that the VAPIX API dynamicoverlay.cgi did not have a…
-
Low 3.8
Erik de Jong, member of the AXIS OS Bug Bounty Program, has found that the VAPIX API ftptest.cgi did not have a suffici…
-
Medium 4.3
51l3nc3, member of the AXIS OS Bug Bounty Program, has found that the VAPIX API managedoverlayimages.cgi was vulnerable…