Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
8.8

VAPIX API tcptest.cgi Allows Unauthenticated Code Execution

CVE-2023-5677 · published 2 years ago
Summary

The VAPIX API has a flaw that could allow hackers to run malicious code on the system if they have operator or administrator access. This could lead to unauthorized access and control over the system. To protect yourself, follow the instructions in the Axis security advisory for a solution.

What to do
  • Update axis m3024-lve_firmware to version 5.51.7.7 or later.
  • Update axis m3025-ve_firmware to version 5.51.7.7 or later.
  • Update axis m7014_firmware to version 5.51.7.7 or later.
  • Update axis m7016_firmware to version 5.51.7.7 or later.
  • Update axis p1214-e_firmware to version 5.51.7.7 or later.
  • Update axis p7214_firmware to version 5.51.7.7 or later.
  • Update axis p7216_firmware to version 5.51.7.7 or later.
  • Update axis q7401_firmware to version 5.51.7.7 or later.
  • Update axis q7404_firmware to version 5.51.7.7 or later.
  • Update axis q7414_firmware to version 5.51.7.7 or later.
  • Update axis q7424-r_mk_ii_firmware to version 5.51.3.9 or later.
Affected software
VendorProductAffected versions
axis m3024-lve_firmware < 5.51.7.7
cpe:2.3:o:axis:m3024-lve_firmware:*:*:*:*:*:*:*:*
axis m3025-ve_firmware < 5.51.7.7
cpe:2.3:o:axis:m3025-ve_firmware:*:*:*:*:*:*:*:*
axis m7014_firmware < 5.51.7.7
cpe:2.3:o:axis:m7014_firmware:*:*:*:*:*:*:*:*
axis m7016_firmware < 5.51.7.7
cpe:2.3:o:axis:m7016_firmware:*:*:*:*:*:*:*:*
axis p1214-e_firmware < 5.51.7.7
cpe:2.3:o:axis:p1214-e_firmware:*:*:*:*:*:*:*:*
axis p7214_firmware < 5.51.7.7
cpe:2.3:o:axis:p7214_firmware:*:*:*:*:*:*:*:*
axis p7216_firmware < 5.51.7.7
cpe:2.3:o:axis:p7216_firmware:*:*:*:*:*:*:*:*
axis q7401_firmware < 5.51.7.7
cpe:2.3:o:axis:q7401_firmware:*:*:*:*:*:*:*:*
axis q7404_firmware < 5.51.7.7
cpe:2.3:o:axis:q7404_firmware:*:*:*:*:*:*:*:*
axis q7414_firmware < 5.51.7.7
cpe:2.3:o:axis:q7414_firmware:*:*:*:*:*:*:*:*
axis q7424-r_mk_ii_firmware < 5.51.3.9
cpe:2.3:o:axis:q7424-r_mk_ii_firmware:*:*:*:*:*:*:*:*
Original advisory text
Brandon Rothel from QED Secure Solutions and Sam Hanson of Dragos have found that the VAPIX API tcptest.cgi did not have a sufficient input validation allowing for a possible remote code execution....
Brandon
Rothel from QED Secure Solutions and Sam Hanson of Dragos have found that the VAPIX API tcptest.cgi
did not have a sufficient input validation allowing for a possible remote code
execution. This flaw can only be exploited after authenticating with an
operator- or administrator-privileged service account. The impact of exploiting
this vulnerability is lower with operator-privileges compared to
administrator-privileges service accounts. Please refer to the Axis security advisory
for more information and solution.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker full control
Severity
8.8 High
Exploitation
<1% chance of attack within 30 days
Type
CWE-78OS Command Injection
CWE-94Code Injection
Timeline
Published5 Feb 2024
Updated4 Nov 2026
First seen7 Mar 2026
Sources
CVE-2023-5677 · NVD
Track software like this
Free during beta