PT-2023-7483 · Axis · Axis Network Intercoms+1

Published 2023-07-25 · Updated 2024-11-08 · CVE-2023-21405

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Axis Network Door Controllers and Axis Network Intercoms (affected versions not specified)

Description The issue is related to a flaw in the implementation of the Open Supervised Device Protocol (OSDP) in Axis Network Door Controllers and Axis Network Intercoms. This flaw causes the OSDP message parser to crash the pacsiod process, resulting in a temporary unavailability of door-controlling functionalities, meaning doors cannot be opened or closed. No sensitive or customer data can be extracted as the Axis device is not further compromised.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Check for Exceptional Conditions

Improper Resource Release

Weakness Enumeration

CWE-754

CWE-1286

CWE-404

Related Identifiers

BDU:2023-08527

CVE-2023-21405

Affected Products

Axis Network Door Controllers

Axis Network Intercoms

References · 8

• https://osv.dev/vulnerability/CVE-2023-21405 · Vendor Advisory
• https://axis.com/dam/public/7f/3a/ed/cve-2023-21405-en-US-407244.pdf · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-21405 · Security Note
• https://bdu.fstec.ru/vul/2023-08527 · Security Note
• https://t.me/cvenotify/99937 · Telegram Post
• https://t.me/cibsecurity/67209 · Telegram Post
• https://t.me/cvenotify/101042 · Telegram Post
• https://vuldb.com/es/?id.235281 · Note