VYPR
← All advisories
Low severity3.8NVD Advisory· Published Nov 26, 2024· Updated Jun 17, 2026

CVE-2024-8160

CVE-2024-8160

Description

Erik de Jong, member of the AXIS OS Bug Bounty Program, has found that the VAPIX API ftptest.cgi did not have a sufficient input validation allowing for a possible command injection leading to being able to transfer files from/to the Axis device. This flaw can only be exploited after authenticating with an administrator-privileged service account. Axis has released patched AXIS OS versions for the highlighted flaw. Please refer to the Axis security advisory for more information and solution.

Affected products

5
  • Axis/AXIS OSllm-fuzzy3 versions
    (expand)+ 2 more
    • (no CPE)
    • cpe:2.3:o:axis:axis_os:*:*:*:*:active:*:*:*range: >=10.9.0,<12.1.21
    • (no CPE)range: 10.9.0
  • Axis/Axis OS 2022
    cpe:2.3:o:axis:axis_os_2022:*:*:*:*:lts:*:*:*
    Range: <10.12.257
  • Axis/Axis OS 2024
    cpe:2.3:o:axis:axis_os_2024:*:*:*:*:lts:*:*:*
    Range: <11.11.116

Patches

Vulnerability mechanics

References

1

News mentions

0

No linked articles in our index yet.