https://vulnogram.org/ Most recent CVEs assigned by Axis Communications AB (axis). https://vulnogram.org/seaview/icons/axis.png https://vulnogram.org/ Wed, 21 Oct 2026 07:00:06 GMT https://vulnogram.org/CVE-2026-4757 https://vulnogram.org/CVE-2026-4757 A VAPIX API parameter had improper input validation which could allow code execution and potentially lead to a privilege escalation. This flaw can only be exploited after authenticating with an administrator-privileged service account. High Tue, 11 Aug 2026 05:52:33 GMT https://vulnogram.org/CVE-2026-6505 https://vulnogram.org/CVE-2026-6505 The ACAP framework contains a Time-of-Check to Time-of-Use (TOCTOU) race condition, which could potentially lead to privilege escalation. This vulnerability can only be exploited if the Axis device is configured to allow the installation of unsigned… Medium Tue, 11 Aug 2026 05:49:51 GMT https://vulnogram.org/CVE-2026-5304 https://vulnogram.org/CVE-2026-5304 An ACAP configuration file lacks input validation, which could potentially lead to privilege escalation. This vulnerability can only be exploited if the Axis device is configured to allow the installation of unsigned ACAP applications, and if an atta… Medium Tue, 11 Aug 2026 05:47:49 GMT https://vulnogram.org/CVE-2026-5303 https://vulnogram.org/CVE-2026-5303 The ACAP framework contains a Time-of-Check to Time-of-Use (TOCTOU) race condition, which could potentially lead to privilege escalation. This vulnerability can only be exploited if the Axis device is configured to allow the installation of unsigned… Medium Tue, 11 Aug 2026 05:45:56 GMT https://vulnogram.org/CVE-2026-8158 https://vulnogram.org/CVE-2026-8158 The Signed Video Framework contained a buffer overflow issue which could lead the application using this framework to crash. The issue exclusively affects the tools used for the validation of signed content. The AXIS OS device's signed video function… Medium Network Exploitable Tue, 11 Aug 2026 05:43:06 GMT https://vulnogram.org/CVE-2026-6181 https://vulnogram.org/CVE-2026-6181 The Device Configuration Framework is vulnerable to an authentication bypass flaw. This flaw can only be exploited after authenticating with a viewer-privileged service account. Medium Tue, 11 Aug 2026 05:38:14 GMT https://vulnogram.org/CVE-2026-1185 https://vulnogram.org/CVE-2026-1185 A configuration file on the local file system had improper input validation which could allow code execution and potentially lead to privilege escalation. This vulnerability can only be exploited if an attacker can log in to the Axis device using SSH… Medium Tue, 12 May 2026 05:49:46 GMT https://vulnogram.org/CVE-2026-0804 https://vulnogram.org/CVE-2026-0804 An ACAP configuration file lacked sufficient input validation, which could allow a path traversal attack leading to potential privilege escalation. This vulnerability can only be exploited if the Axis device is configured to allow the installation of… Medium Tue, 12 May 2026 05:46:45 GMT https://vulnogram.org/CVE-2026-0802 https://vulnogram.org/CVE-2026-0802 An ACAP configuration file lacked sufficient input validation, which could allow command injection and potentially lead to privilege escalation. This vulnerability can only be exploited if the Axis device is configured to allow the installation of un… Medium Tue, 12 May 2026 05:44:59 GMT https://vulnogram.org/CVE-2026-0541 https://vulnogram.org/CVE-2026-0541 ACAP applications can gain elevated privileges due to improper input validation during the installation process, potentially leading to privilege escalation. This vulnerability can only be exploited if the Axis device is configured to allow the insta… Medium Tue, 12 May 2026 05:42:27 GMT https://vulnogram.org/CVE-2025-12063 https://vulnogram.org/CVE-2025-12063 An insecure direct object reference allowed a non-admin user to modify or remove certain data objects without having the appropriate permissions. Medium Tue, 10 Feb 2026 05:52:35 GMT https://vulnogram.org/CVE-2025-12757 https://vulnogram.org/CVE-2025-12757 An AXIS Camera Station Pro feature can be exploited in a way that allows a non-admin user to view information they are not permitted to. Medium Tue, 10 Feb 2026 05:47:20 GMT https://vulnogram.org/CVE-2025-13064 https://vulnogram.org/CVE-2025-13064 A server-side injection was possible for a malicious admin to manipulate the application to include a malicious script which is executed by the server. This attack is only possible if the admin uses a client that have been tampered with. Medium Tue, 10 Feb 2026 05:40:34 GMT https://vulnogram.org/CVE-2025-11547 https://vulnogram.org/CVE-2025-11547 AXIS Camera Station Pro contained a flaw to perform a privilege escalation attack on the server as a non-admin user. High Tue, 10 Feb 2026 05:35:50 GMT https://vulnogram.org/CVE-2025-11142 https://vulnogram.org/CVE-2025-11142 The VAPIX API mediaclip.cgi that did not have a sufficient input validation allowing for a possible remote code execution. This flaw can only be exploited after authenticating with an operator- or administrator- privileged service account. High Tue, 10 Feb 2026 05:32:19 GMT https://vulnogram.org/CVE-2025-9055 https://vulnogram.org/CVE-2025-9055 The VAPIX Edge storage API that allowed a privilege escalation, enabling a VAPIX administrator-privileged user to gain Linux Root privileges. This flaw can only be exploited after authenticating with an administrator-privileged service account. Medium Tue, 11 Nov 2025 07:31:00 GMT https://vulnogram.org/CVE-2025-8998 https://vulnogram.org/CVE-2025-8998 It was possible to upload files with a specific name to a temporary directory, which may result in process crashes and impact usability. This flaw can only be exploited after authenticating with an operator- or administrator-privileged service accoun… Low Tue, 11 Nov 2025 07:28:40 GMT https://vulnogram.org/CVE-2025-9524 https://vulnogram.org/CVE-2025-9524 The VAPIX API port.cgi did not have sufficient input validation, which may result in process crashes and impact usability. This vulnerability can only be exploited after authenticating with a viewer- operator- or administrator-privileged service acco… Medium Tue, 11 Nov 2025 07:25:45 GMT https://vulnogram.org/CVE-2025-10714 https://vulnogram.org/CVE-2025-10714 AXIS Optimizer was vulnerable to an unquoted search path vulnerability, which could potentially lead to privilege escalation within Microsoft Windows operating system. This vulnerability can only be exploited if the attacker has access to the local W… High Tue, 11 Nov 2025 07:16:05 GMT https://vulnogram.org/CVE-2025-8108 https://vulnogram.org/CVE-2025-8108 An ACAP configuration file has improper permissions and lacks input validation, which could potentially lead to privilege escalation. This vulnerability can only be exploited if the Axis device is configured to allow the installation of unsigned ACAP… Medium Tue, 11 Nov 2025 07:10:31 GMT https://vulnogram.org/CVE-2025-6779 https://vulnogram.org/CVE-2025-6779 An ACAP configuration file has improper permissions, which could allow command injection and potentially lead to privilege escalation. This vulnerability can only be exploited if the Axis device is configured to allow the installation of unsigned ACA… Medium Tue, 11 Nov 2025 07:05:51 GMT https://vulnogram.org/CVE-2025-6571 https://vulnogram.org/CVE-2025-6571 A 3rd-party component exposed its password in process arguments, allowing for low-privileged users to access it. Medium Tue, 11 Nov 2025 07:03:19 GMT https://vulnogram.org/CVE-2025-5452 https://vulnogram.org/CVE-2025-5452 A malicious ACAP application can gain access to admin-level service account credentials used by legitimate ACAP applications, leading to potential privilege escalation of the malicious ACAP application. This vulnerability can only be exploited if the… Medium Tue, 11 Nov 2025 07:00:46 GMT https://vulnogram.org/CVE-2025-6298 https://vulnogram.org/CVE-2025-6298 ACAP applications can gain elevated privileges due to improper input validation, potentially leading to privilege escalation. This vulnerability can only be exploited if the Axis device is configured to allow the installation of unsigned ACAP applica… Medium Tue, 11 Nov 2025 06:56:50 GMT https://vulnogram.org/CVE-2025-5718 https://vulnogram.org/CVE-2025-5718 The ACAP Application framework could allow privilege escalation through a symlink attack. This vulnerability can only be exploited if the Axis device is configured to allow the installation of unsigned ACAP applications, and if an attacker convinces… Medium Tue, 11 Nov 2025 06:52:33 GMT https://vulnogram.org/CVE-2025-5454 https://vulnogram.org/CVE-2025-5454 An ACAP configuration file lacked sufficient input validation, which could allow a path traversal attack leading to potential privilege escalation. This vulnerability can only be exploited if the Axis device is configured to allow the installation of… Medium Tue, 11 Nov 2025 06:50:19 GMT https://vulnogram.org/CVE-2025-4645 https://vulnogram.org/CVE-2025-4645 An ACAP configuration file lacked sufficient input validation, which could allow for arbitrary code execution. This vulnerability can only be exploited if the Axis device is configured to allow the installation of unsigned ACAP applications, and if a… Medium Tue, 11 Nov 2025 06:45:29 GMT https://vulnogram.org/CVE-2025-30027 https://vulnogram.org/CVE-2025-30027 An ACAP configuration file lacked sufficient input validation, which could allow for arbitrary code execution. This vulnerability can only be exploited if the Axis device is configured to allow the installation of unsigned ACAP applications, and if a… Medium Tue, 12 Aug 2025 05:18:26 GMT https://vulnogram.org/CVE-2025-3892 https://vulnogram.org/CVE-2025-3892 ACAP applications can be executed with elevated privileges, potentially leading to privilege escalation. This vulnerability can only be exploited if the Axis device is configured to allow the installation of unsigned ACAP applications, and if an atta… Medium Tue, 12 Aug 2025 05:14:43 GMT https://vulnogram.org/CVE-2025-7622 https://vulnogram.org/CVE-2025-7622 During an internal security assessment, a Server-Side Request Forgery (SSRF) vulnerability that allowed an authenticated attacker to access internal resources on the server was discovered. Medium Tue, 12 Aug 2025 05:09:23 GMT https://vulnogram.org/CVE-2025-30026 https://vulnogram.org/CVE-2025-30026 The AXIS Camera Station Server had a flaw that allowed to bypass authentication that is normally required. Medium Fri, 11 Jul 2025 06:05:33 GMT https://vulnogram.org/CVE-2025-30025 https://vulnogram.org/CVE-2025-30025 The communication protocol used between the server process and the service control had a flaw that could lead to a local privilege escalation. Medium Fri, 11 Jul 2025 06:04:40 GMT https://vulnogram.org/CVE-2025-30024 https://vulnogram.org/CVE-2025-30024 The communication protocol used between client and server had a flaw that could be leveraged to execute a man in the middle attack. Medium Network Exploitable Fri, 11 Jul 2025 06:03:29 GMT https://vulnogram.org/CVE-2025-30023 https://vulnogram.org/CVE-2025-30023 The communication protocol used between client and server had a flaw that could lead to an authenticated user performing a remote code execution attack. Critical Fri, 11 Jul 2025 06:02:00 GMT https://vulnogram.org/CVE-2025-0358 https://vulnogram.org/CVE-2025-0358 During an annual penetration test conducted on behalf of Axis Communication, Truesec discovered a flaw in the VAPIX Device Configuration framework that allowed a privilege escalation, enabling a lower-privileged user to gain administrator privileges. High Mon, 02 Jun 2025 07:39:50 GMT https://vulnogram.org/CVE-2025-0325 https://vulnogram.org/CVE-2025-0325 A Guard Tour VAPIX API parameter allowed the use of arbitrary values and can be incorrectly called, allowing an attacker to block access to the guard tour configuration page in the web interface of the Axis device. Medium Mon, 02 Jun 2025 07:36:55 GMT https://vulnogram.org/CVE-2025-0324 https://vulnogram.org/CVE-2025-0324 The VAPIX Device Configuration framework allowed a privilege escalation, enabling a lower-privileged user to gain administrator privileges. Critical Network Exploitable Mon, 02 Jun 2025 07:32:56 GMT https://vulnogram.org/CVE-2025-0926 https://vulnogram.org/CVE-2025-0926 Gee-netics, member of AXIS Camera Station Pro Bug Bounty Program, has found that it is possible for a non-admin user to remove system files causing a boot loop by redirecting a file deletion when recording video. Axis has released a patched version f… Medium Wed, 23 Apr 2025 05:22:03 GMT https://vulnogram.org/CVE-2025-1056 https://vulnogram.org/CVE-2025-1056 Gee-netics, member of AXIS Camera Station Pro Bug Bounty Program, has identified an issue with a specific file that the server is using. A non-admin user can modify this file to either create files or change the content of files in an admin-protected… Medium Wed, 23 Apr 2025 05:18:10 GMT https://vulnogram.org/CVE-2025-0361 https://vulnogram.org/CVE-2025-0361 During an annual penetration test conducted on behalf of Axis Communications, Truesec discovered a flaw in the VAPIX Device Configuration framework that allowed for unauthenticated username enumeration through the VAPIX Device Configuration SSH Manag… Medium Tue, 08 Apr 2025 05:38:02 GMT https://vulnogram.org/CVE-2024-47261 https://vulnogram.org/CVE-2024-47261 51l3nc3, a member of the AXIS OS Bug Bounty Program, has found that the VAPIX API uploadoverlayimage.cgi did not have sufficient input validation to allow an attacker to upload files to block access to create image overlays in the web interface of th… Medium Tue, 08 Apr 2025 05:33:58 GMT https://vulnogram.org/CVE-2025-0360 https://vulnogram.org/CVE-2025-0360 During an annual penetration test conducted on behalf of Axis Communication, Truesec discovered a flaw in the VAPIX Device Configuration framework that could lead to an incorrect user privilege level in the VAPIX service account D-Bus API. High Tue, 04 Mar 2025 05:24:00 GMT https://vulnogram.org/CVE-2025-0359 https://vulnogram.org/CVE-2025-0359 During an annual penetration test conducted on behalf of Axis Communication, Truesec discovered a flaw in the ACAP Application framework that allowed applications to access restricted D-Bus methods within the framework. Axis has released patched AXIS… High Tue, 04 Mar 2025 05:21:34 GMT https://vulnogram.org/CVE-2024-47262 https://vulnogram.org/CVE-2024-47262 Dzmitry Lukyanenka, member of the AXIS OS Bug Bounty Program, has found that the VAPIX API param.cgi was vulnerable to a race condition attack allowing for an attacker to block access to the web interface of the Axis device. Other API endpoints or se… Medium Network Exploitable Tue, 04 Mar 2025 05:19:09 GMT https://vulnogram.org/CVE-2024-47260 https://vulnogram.org/CVE-2024-47260 51l3nc3, member of the AXIS OS Bug Bounty Program, has found that the VAPIX API mediaclip.cgi did not have a sufficient input validation allowing for uploading more audio clips then designed resulting in the Axis device running out of memory. Axis ha… Medium Tue, 04 Mar 2025 05:17:35 GMT https://vulnogram.org/CVE-2024-47259 https://vulnogram.org/CVE-2024-47259 Girishunawane, member of the AXIS OS Bug Bounty Program, has found that the VAPIX API dynamicoverlay.cgi did not have a sufficient input validation allowing for a possible command injection leading to being able to transfer files to the Axis device w… Low Tue, 04 Mar 2025 05:15:16 GMT https://vulnogram.org/CVE-2024-47258 https://vulnogram.org/CVE-2024-47258 2N Access Commander version 2.1 and prior is vulnerable in default settings to Man In The Middle attack due to not verifying certificates of 2N edge devices. 2N has currently released an updated version 3.3 of 2N Access Commander, with added Certific… High Thu, 06 Feb 2025 19:10:40 GMT https://vulnogram.org/CVE-2024-47256 https://vulnogram.org/CVE-2024-47256 Successful exploitation of this vulnerability could allow an attacker (who needs to have Admin access privileges) to read hardcoded AES passphrase, which may be used for decryption of certain data within backup files of 2N Access Commander version 1.… Medium Thu, 06 Feb 2025 19:10:03 GMT https://vulnogram.org/CVE-2024-13417 https://vulnogram.org/CVE-2024-13417 Specifically crafted payloads sent to the RFID reader could cause DoS of RFID reader. After the device is restarted, it gets back to fully working state. 2N has released an updated version 2.46 of 2N OS, where this vulnerability is mitigated. It is r… Medium Thu, 06 Feb 2025 19:09:38 GMT https://vulnogram.org/CVE-2024-13416 https://vulnogram.org/CVE-2024-13416 Using API in the 2N OS device, authorized user can enable logging, which discloses valid authentication tokens in system log. 2N has released an updated version 2.46 of 2N OS, where this vulnerability is mitigated. It is recommended that all customer… Medium Thu, 06 Feb 2025 19:09:06 GMT