medium6.3
CVE-2023-5677
Brandon Rothel from QED Secure Solutions and Sam Hanson of Dragos have found that the VAPIX API tcptest.cgi did not have a sufficient input validation allowing…
Impact
Brandon Rothel from QED Secure Solutions and Sam Hanson of Dragos have found that the VAPIX API tcptest.cgi did not have a sufficient input validation allowing for a possible remote code execution. This flaw can only be exploited after authenticating with an operator- or administrator-privileged service account. The impact of exploiting this vulnerability is lower with operator-privileges compared to administrator-privileges service accounts. Please refer to the Axis security advisory for more information and solution.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Axis | M3024-Lve Firmware | before 5.51.7.7 |
| Axis | M3025-Ve Firmware | before 5.51.7.7 |
| Axis | M7014 Firmware | before 5.51.7.7 |
| Axis | M7016 Firmware | before 5.51.7.7 |
| Axis | P1214-E Firmware | before 5.51.7.7 |
| Axis | P7214 Firmware | before 5.51.7.7 |
| Axis | P7216 Firmware | before 5.51.7.7 |
| Axis | Q7401 Firmware | before 5.51.7.7 |
| Axis | Q7404 Firmware | before 5.51.7.7 |
| Axis | Q7414 Firmware | before 5.51.7.7 |
| Axis | Q7424-R Mk Ii Firmware | before 5.51.3.9 |