PT-2023-7489 · Axis Communications · Axis Os

Published 2023-11-21 · Updated 2024-11-08 · CVE-2023-21418

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:S/C:N/I:P/A:C

Name of the Vulnerable Software and Affected Versions AXIS OS (affected versions not specified)

Description The VAPIX API irissetup.cgi is vulnerable to path traversal attacks, allowing for file deletion. This issue can only be exploited after authenticating with an operator- or administrator-privileged service account. The impact of exploiting this issue is lower with operator service accounts and limited to non-system files compared to administrator-privileges.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Path traversal

Weakness Enumeration

CWE-35

CWE-22

Related Identifiers

BDU:2023-08533

CVE-2023-21418

Affected Products

Axis Os

References · 8

• https://axis.com/dam/public/49/93/55/cve-2023-21418-en-US-417792.pdf · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-21418 · Security Note
• https://osv.dev/vulnerability/CVE-2023-21418 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-08533 · Security Note
• https://t.me/cvenotify/60926 · Telegram Post
• https://t.me/cvenotify/61383 · Telegram Post
• https://vuldb.com/ru/?id.245884 · Note
• https://t.me/cvenotify/60902 · Telegram Post