Description
Vintage,
member of the AXIS OS Bug Bounty Program, has found that the VAPIX API create_overlay.cgi
did not have a sufficient input validation allowing for a possible remote code
execution. This flaw can only be exploited after authenticating with an
operator- or administrator-privileged service account. Axis has released patched AXIS OS
versions for the highlighted flaw. Please refer to the Axis security advisory
for more information and solution.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Axis Communications AB | AXIS OS | AXIS OS 11.8, 10.12, 9.80, 8.40, 6.50 | — |