VYPR
← All advisories
High severity7.1NVD Advisory· Published Nov 21, 2023· Updated Jun 17, 2026

CVE-2023-21417

CVE-2023-21417

Description

Sandro Poppi, member of the AXIS OS Bug Bounty Program,

has found that the VAPIX API manageoverlayimage.cgi was vulnerable to path traversal attacks that allows for file/folder deletion. This flaw can only be exploited after authenticating with an operator- or administrator- privileged service account. The impact of exploiting this vulnerability is lower with operator service accounts and limited to non-system files compared to administrator-privileges. Axis has released patched AXIS OS versions for the highlighted flaw. Please refer to the Axis security advisory for more information and solution.

Affected products

6
  • Axis/AXIS OS3 versions
    cpe:2.3:o:axis:axis_os:*:*:*:*:active:*:*:*+ 2 more
    • cpe:2.3:o:axis:axis_os:*:*:*:*:active:*:*:*range: <11.7.57
    • (no CPE)
    • (no CPE)range: AXIS OS 8.50 – 11.6
  • Axis/Axis OS 2020
    cpe:2.3:o:axis:axis_os_2020:*:*:*:*:lts:*:*:*
    Range: <9.80.49
  • Axis/Axis OS 2022
    cpe:2.3:o:axis:axis_os_2022:*:*:*:*:lts:*:*:*
    Range: <10.12.208
  • Axis/VAPIX APIllm-fuzzy

Patches

Vulnerability mechanics

References

1

News mentions

0

No linked articles in our index yet.