PT-2023-7487 · Axis Communications · Axis Os

Published 2023-10-16 · Updated 2024-11-08 · CVE-2023-21415

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions AXIS OS versions prior to the patched version

Description The issue is related to the VAPIX API in the AXIS OS, specifically with the overlay del.cgi endpoint, which is vulnerable to path traversal attacks. This allows an attacker, after authenticating with an operator- or administrator-privileged service account, to delete arbitrary files. The exploitation of this issue can be done remotely.

Recommendations For versions prior to the patched version, update to the latest AXIS OS version that includes the fix for this issue. As a temporary workaround, consider restricting access to the overlay del.cgi endpoint until a patch is available. Avoid using the overlay del.cgi endpoint with operator- or administrator-privileged service accounts until the issue is resolved.

Fix

Path traversal

Weakness Enumeration

CWE-35

CWE-22

Related Identifiers

BDU:2023-08531

CVE-2023-21415

Affected Products

Axis Os

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2023-21415 · Security Note
• https://bdu.fstec.ru/vul/2023-08531 · Security Note
• https://axis.com/dam/public/b6/55/e2/cve-2023-21415pdf-en-US-416245.pdf · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-21415 · Vendor Advisory
• https://vuldb.com/ru/?id.242211 · Note
• https://t.me/cvenotify/59732 · Telegram Post
• https://t.me/cvenotify/59505 · Telegram Post