Axis Security Vulnerabilities (CVEs)

This CVE describes an insecure direct object reference vulnerability where non-admin users can modify or delete data objects they shouldn't have acces...

CVE-2025-12757 is an information disclosure vulnerability in AXIS Camera Station Pro where non-admin users can access restricted information. This aff...

This CVE describes a server-side injection vulnerability where a malicious administrator with a tampered client can inject and execute malicious scrip...

CVE-2025-11547 is a privilege escalation vulnerability in AXIS Camera Station Pro that allows authenticated non-admin users to gain administrative pri...

CVE-2025-11142 is an OS command injection vulnerability in Axis camera VAPIX API's mediaclip.cgi endpoint that allows authenticated attackers with ope...

This CVE describes a privilege escalation vulnerability in Axis devices where improper permissions and lack of input validation in ACAP configuration ...

This CVE describes a privilege escalation vulnerability in the ACAP Application framework through symlink attacks. It affects Axis devices configured ...

This CVE describes a privilege escalation vulnerability in Axis ACAP applications where improper input validation allows malicious applications to gai...

CVE-2025-6779 is an improper permissions vulnerability in ACAP configuration files on Axis devices that could allow command injection and privilege es...

This CVE describes a path traversal vulnerability in Axis ACAP configuration files that could allow privilege escalation. It affects Axis devices conf...

This vulnerability allows malicious ACAP applications to steal admin-level service account credentials from legitimate ACAP applications on Axis devic...

CVE-2025-3892 is a privilege escalation vulnerability in Axis devices that allows ACAP applications to execute with elevated privileges. This affects ...

This CVE describes an ACAP configuration file vulnerability in Axis devices that lacks sufficient input validation, potentially allowing arbitrary cod...

This CVE describes a Server-Side Request Forgery (SSRF) vulnerability that allows authenticated attackers to make the server send requests to internal...

This vulnerability allows a local attacker to escalate privileges by exploiting a flaw in the communication protocol between server processes and serv...

This vulnerability in Axis Communications' VAPIX Device Configuration framework allows lower-privileged users to escalate their privileges to administ...

A non-admin user can delete critical system files by exploiting a file deletion redirection vulnerability during video recording in Axis Camera Statio...

This vulnerability allows attackers to upload files via the VAPIX API uploadoverlayimage.cgi endpoint in Axis devices, potentially blocking access to ...

This vulnerability in Axis Communication's ACAP Application framework allows applications to bypass D-Bus method restrictions, potentially enabling un...

This vulnerability allows authenticated attackers to tamper with audit logs or perform denial-of-service attacks on AXIS Camera Station servers by cra...

CVE-2024-6979 is a broken access control vulnerability in AXIS OS that allows less-privileged operator or viewer accounts to gain elevated privileges ...

This vulnerability allows attackers to bypass Secure Boot protection on AXIS OS devices, potentially enabling unauthorized firmware modifications or p...

This CVE describes a path traversal vulnerability in Axis camera systems' VAPIX API manageoverlayimage.cgi endpoint that allows authenticated users wi...

This vulnerability allows attackers to bypass Secure Boot protection on Axis devices, potentially enabling unauthorized firmware modifications or pers...

CVE-2023-21411 is an OS command injection vulnerability in Axis camera access control settings that allows authenticated attackers to execute arbitrar...

CVE-2023-21407 is a broken access control vulnerability in Axis Communications products that allows operator accounts to escalate privileges to admini...

This vulnerability allows unprivileged users to access administrator credentials due to insufficient file permissions. Attackers could use these crede...

A heap-based buffer overflow vulnerability in AXIS A1001's OSDP communication handler allows attackers to write data beyond allocated memory boundarie...

CVE-2022-23410 is a DLL hijacking vulnerability in AXIS IP Utility that allows attackers to execute arbitrary code with elevated privileges. It affect...

CVE-2021-31987 is an input validation vulnerability in Axis Communications products that allows attackers to bypass blocked SMTP recipients. This affe...