CVE-2024-8160

Description

Erik de Jong, member of the AXIS OS Bug Bounty Program, has found that the VAPIX API ftptest.cgi did not have a sufficient input validation allowing for a possible command injection leading to being able to transfer files from/to the Axis device. This flaw can only be exploited after authenticating with an administrator-privileged service account. Axis has released patched AXIS OS versions for the highlighted flaw. Please refer to the Axis security advisory for more information and solution.

Reserved 2024-08-26 | Published 2024-11-26 | Updated 2024-11-26 | Assigner Axis

Problem types

CWE-1286: Improper Validation of Syntactic Correctness of Input

Product status

Default status
unaffected

10.9 - 12.0
affected

References

www.axis.com/...cve-2024-8160pdf-en-US_InternalID-231071.pdf

cve.org (CVE-2024-8160)

nvd.nist.gov (CVE-2024-8160)

Download JSON