PT-2023-7484 · Axis · Axis Os

Published 2023-11-21 · Updated 2024-11-08 · CVE-2023-21417

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:S/C:N/I:P/A:C

Name of the Vulnerable Software and Affected Versions AXIS OS versions prior to the patched version

Description The issue is related to the VAPIX API in the AXIS OS, specifically with the manageoverlayimage.cgi endpoint. It allows for path traversal attacks, enabling an attacker to delete arbitrary files after authenticating with an operator- or administrator-privileged service account. The impact of exploiting this issue is lower with operator service accounts and is limited to non-system files compared to administrator-privileges.

Recommendations For versions prior to the patched version, update to the patched AXIS OS version as released by Axis to resolve the issue. As a temporary workaround, consider restricting access to the manageoverlayimage.cgi endpoint until a patch is applied. Additionally, limit the use of administrator-privileged service accounts to minimize the risk of exploitation.

Fix

Path traversal

Weakness Enumeration

CWE-35

CWE-22

Related Identifiers

BDU:2023-08528

CVE-2023-21417

Affected Products

Axis Os

References · 8

• https://axis.com/dam/public/2a/82/12/cve-2023-21417-en-US-417791.pdf · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-21417 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-08528 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-21417 · Security Note
• https://t.me/cvenotify/61382 · Telegram Post
• https://t.me/cvenotify/60901 · Telegram Post
• https://t.me/cvenotify/60925 · Telegram Post
• https://vuldb.com/ru/?id.245883 · Note