Medium severity6.3NVD Advisory· Published Feb 5, 2024· Updated Jun 17, 2026

CVE-2023-5677

Description

Brandon Rothel from QED Secure Solutions and Sam Hanson of Dragos have found that the VAPIX API tcptest.cgi did not have a sufficient input validation allowing for a possible remote code execution. This flaw can only be exploited after authenticating with an operator- or administrator-privileged service account. The impact of exploiting this vulnerability is lower with operator-privileges compared to administrator-privileges service accounts. Please refer to the Axis security advisory for more information and solution.

Affected products

Axis/M3024 Lve Firmware
cpe:2.3:o:axis:m3024-lve_firmware:*:*:*:*:*:*:*:*
Range: <5.51.7.7
Axis/M3025 Ve Firmware
cpe:2.3:o:axis:m3025-ve_firmware:*:*:*:*:*:*:*:*
Range: <5.51.7.7
Axis/M7014 Firmware
cpe:2.3:o:axis:m7014_firmware:*:*:*:*:*:*:*:*
Range: <5.51.7.7
Axis/M7016 Firmware
cpe:2.3:o:axis:m7016_firmware:*:*:*:*:*:*:*:*
Range: <5.51.7.7
Axis/P1214 E Firmware
cpe:2.3:o:axis:p1214-e_firmware:*:*:*:*:*:*:*:*
Range: <5.51.7.7
Axis/P7214 Firmware
cpe:2.3:o:axis:p7214_firmware:*:*:*:*:*:*:*:*
Range: <5.51.7.7
Axis/P7216 Firmware
cpe:2.3:o:axis:p7216_firmware:*:*:*:*:*:*:*:*
Range: <5.51.7.7
Axis/Q7401 Firmware
cpe:2.3:o:axis:q7401_firmware:*:*:*:*:*:*:*:*
Range: <5.51.7.7
Axis/Q7404 Firmware
cpe:2.3:o:axis:q7404_firmware:*:*:*:*:*:*:*:*
Range: <5.51.7.7
Axis/Q7414 Firmware
cpe:2.3:o:axis:q7414_firmware:*:*:*:*:*:*:*:*
Range: <5.51.7.7
Axis/Q7424 R Mk Ii Firmware
cpe:2.3:o:axis:q7424-r_mk_ii_firmware:*:*:*:*:*:*:*:*
Range: <5.51.3.9
Axis/VAPIX APIllm-fuzzy
Axis/AXIS OScpe-rescue
Range: AXIS OS 5.51

cvss	0.410
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000

CVE-2023-5677

Description

Affected products

Patches

Vulnerability mechanics

References

News mentions