Vulnerability Details CVE-2023-5677
Brandon
Rothel from QED Secure Solutions has found that the VAPIX API tcptest.cgi
did not have a sufficient input validation allowing for a possible remote code
execution. This flaw can only be exploited after authenticating with an
operator- or administrator-privileged service account. The impact of exploiting
this vulnerability is lower with operator-privileges compared to
administrator-privileges service accounts. Axis has released patched AXIS OS
versions for the highlighted flaw. Please refer to the Axis security advisory
for more information and solution.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.001
EPSS Ranking 20.1%
CVSS Severity
CVSS v3 Score 6.3
References
Products affected by CVE-2023-5677
-
cpe:2.3:h:axis:m3024-lve:-
-
cpe:2.3:h:axis:m3025-ve:-
-
cpe:2.3:h:axis:m7014:-
-
cpe:2.3:h:axis:m7016:-
-
cpe:2.3:h:axis:p1214-e:-
-
cpe:2.3:h:axis:p7214:-
-
cpe:2.3:h:axis:p7216:-
-
cpe:2.3:h:axis:q7401:-
-
cpe:2.3:h:axis:q7404:-
-
cpe:2.3:h:axis:q7414:-
-
cpe:2.3:h:axis:q7424-r_mk_ii:-
-
cpe:2.3:o:axis:m3024-lve_firmware:5.51.5
-
cpe:2.3:o:axis:m3025-ve_firmware:5.51.5
-
cpe:2.3:o:axis:m7014_firmware:5.51.5
-
cpe:2.3:o:axis:m7016_firmware:5.51.5
-
cpe:2.3:o:axis:p1214-e_firmware:5.51.5
-
cpe:2.3:o:axis:p7214_firmware:5.51.5
-
cpe:2.3:o:axis:p7216_firmware:5.51.5
-
cpe:2.3:o:axis:q7401_firmware:5.51.5
-
cpe:2.3:o:axis:q7404_firmware:5.51.5
-
cpe:2.3:o:axis:q7414_firmware:*
-
cpe:2.3:o:axis:q7424-r_mk_ii_firmware:5.51.3.5