PT-2023-7488 · Axis · Axis Os

Published 2023-11-21 · Updated 2024-11-08 · CVE-2023-21416

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:S/C:N/I:P/A:C

Name of the Vulnerable Software and Affected Versions AXIS OS (affected versions not specified)

Description The VAPIX API dynamicoverlay.cgi is vulnerable to a Denial-of-Service attack, allowing an attacker to block access to the overlay configuration page in the web interface of the Axis device. This flaw can only be exploited after authenticating with an operator- or administrator-privileged service account. The impact of the attack is significant, as it can cause a denial of service.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Resource Release

Weakness Enumeration

CWE-35

CWE-404

Related Identifiers

BDU:2023-08532

CVE-2023-21416

Affected Products

Axis Os

References · 8

• https://axis.com/dam/public/35/2a/a6/cve-2023-21416-en-US-417790.pdf · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-21416 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-21416 · Security Note
• https://bdu.fstec.ru/vul/2023-08532 · Security Note
• https://vuldb.com/?id.245879 · Note
• https://t.me/cvenotify/60900 · Telegram Post
• https://t.me/cvenotify/60924 · Telegram Post
• https://t.me/cvenotify/61381 · Telegram Post