VYPR
← All advisories
Medium severity5.4NVD Advisory· Published Feb 5, 2024· Updated Jun 17, 2026

CVE-2023-5800

CVE-2023-5800

Description

Vintage, member of the AXIS OS Bug Bounty Program, has found that the VAPIX API create_overlay.cgi did not have a sufficient input validation allowing for a possible remote code execution. This flaw can only be exploited after authenticating with an operator- or administrator-privileged service account. Axis has released patched AXIS OS versions for the highlighted flaw. Please refer to the Axis security advisory for more information and solution.

Affected products

5
  • Axis/AXIS OS3 versions
    cpe:2.3:o:axis:axis_os:*:*:*:*:active:*:*:*+ 2 more
    • cpe:2.3:o:axis:axis_os:*:*:*:*:active:*:*:*range: <11.8.61
    • (no CPE)
    • (no CPE)range: AXIS OS 11.8, 10.12, 9.80, 8.40, 6.50
  • Axis/Axis OS 2020
    cpe:2.3:o:axis:axis_os_2020:*:*:*:*:lts:*:*:*
    Range: <9.80.55
  • Axis/Axis OS 2022
    cpe:2.3:o:axis:axis_os_2022:*:*:*:*:lts:*:*:*
    Range: <10.12.220

Patches

Vulnerability mechanics

References

1

News mentions

0

No linked articles in our index yet.