Advisories · Technology

Axis Communications AB AXIS OS.

Every CVE that names Axis Communications AB AXIS OS among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.

CVE-2026-4757 CVE record

CVSS 7.2 High

Incorrect permission assignment in Axis Communications AB AXIS OS
- Axis Communications AB AXIS OS
- Broken access control
Not analysed yet 11 Aug 2026
CVE-2026-6505 CVE record

CVSS 5.1 Medium

Time-of-check time-of-use race condition in Axis Communications AB AXIS OS
- Axis Communications AB AXIS OS
- Race condition
Not analysed yet 11 Aug 2026
CVE-2026-5304 CVE record

CVSS 5.7 Medium

An ACAP configuration file lacks input validation, which could potentially lead to privilege escalation.
- Axis Communications AB AXIS OS
- CWE-1287
Not analysed yet 11 Aug 2026
CVE-2026-5303 CVE record

CVSS 5.7 Medium

Time-of-check time-of-use race condition in Axis Communications AB AXIS OS
- Axis Communications AB AXIS OS
- Race condition
Not analysed yet 11 Aug 2026
CVE-2026-6181 CVE record

CVSS 5.9 Medium

Authentication bypass by spoofing in Axis Communications AB AXIS OS
- Axis Communications AB AXIS OS
- Authentication bypass
Not analysed yet 11 Aug 2026
CVE-2026-1185 CVE record

CVSS 5.4 Medium

Incorrect permission assignment in Axis Communications AB AXIS OS
- Axis Communications AB AXIS OS
- Broken access control
Not analysed yet 12 May 2026
CVE-2026-0804 CVE record

CVSS 6.7 Medium

Path traversal in Axis Communications AB AXIS OS
- Axis Communications AB AXIS OS
- Path traversal
Not analysed yet 12 May 2026
CVE-2026-0802 CVE record

CVSS 6.0 Medium

An ACAP configuration file lacked sufficient input validation, which could allow command injection and potentially lead to privilege escalation.
- Axis Communications AB AXIS OS
- CWE-1287
Not analysed yet 12 May 2026
CVE-2026-0541 CVE record

CVSS 6.7 Medium

Incorrect permission assignment in Axis Communications AB AXIS OS
- Axis Communications AB AXIS OS
- Broken access control
Not analysed yet 12 May 2026
CVE-2025-11142 CVE record

CVSS 7.1 High

OS command injection in Axis Communications AB AXIS OS
- Axis Communications AB AXIS OS
- Command injection
Not analysed yet 10 Feb 2026
CVE-2025-9055 CVE record

CVSS 6.4 Medium

Execution with unnecessary privileges in Axis Communications AB AXIS OS
- Axis Communications AB AXIS OS
- Privilege escalation
Not analysed yet 11 Nov 2025
CVE-2025-8998 CVE record

CVSS 3.1 Low

External control of a file path in Axis Communications AB AXIS OS
- Axis Communications AB AXIS OS
- Path traversal
Not analysed yet 11 Nov 2025
CVE-2025-9524 CVE record

CVSS 4.3 Medium

The VAPIX API port.cgi did not have sufficient input validation, which may result in process crashes and impact usability.
- Axis Communications AB AXIS OS
- CWE-1287
Not analysed yet 11 Nov 2025
CVE-2025-8108 CVE record

CVSS 6.7 Medium

Incorrect permission assignment in Axis Communications AB AXIS OS
- Axis Communications AB AXIS OS
- Broken access control
- CWE-1287
Not analysed yet 11 Nov 2025
CVE-2025-6779 CVE record

CVSS 6.7 Medium

Incorrect permission assignment in Axis Communications AB AXIS OS
- Axis Communications AB AXIS OS
- Broken access control
Not analysed yet 11 Nov 2025
CVE-2025-6571 CVE record

CVSS 6.0 Medium

Insufficiently protected credentials in Axis Communications AB AXIS OS
- Axis Communications AB AXIS OS
- Hard-coded credentials
Not analysed yet 11 Nov 2025
CVE-2025-5452 CVE record

CVSS 6.6 Medium

A malicious ACAP application can gain access to admin-level service account credentials used by legitimate ACAP applications, leading to potential privilege escalation of the malicious ACAP applicati…
- Axis Communications AB AXIS OS
- CWE-214
Not analysed yet 11 Nov 2025
CVE-2025-6298 CVE record

CVSS 6.7 Medium

ACAP applications can gain elevated privileges due to improper input validation, potentially leading to privilege escalation.
- Axis Communications AB AXIS OS
- CWE-1287
Not analysed yet 11 Nov 2025
CVE-2025-5718 CVE record

CVSS 6.8 Medium

Symlink following in Axis Communications AB AXIS OS
- Axis Communications AB AXIS OS
- Path traversal
Not analysed yet 11 Nov 2025
CVE-2025-5454 CVE record

CVSS 6.4 Medium

Path traversal in Axis Communications AB AXIS OS
- Axis Communications AB AXIS OS
- Path traversal
Not analysed yet 11 Nov 2025
CVE-2025-4645 CVE record

CVSS 6.7 Medium

An ACAP configuration file lacked sufficient input validation, which could allow for arbitrary code execution.
- Axis Communications AB AXIS OS
- CWE-1287
Not analysed yet 11 Nov 2025
CVE-2025-30027 CVE record

CVSS 6.7 Medium

An ACAP configuration file lacked sufficient input validation, which could allow for arbitrary code execution.
- Axis Communications AB AXIS OS
- CWE-1287
Not analysed yet 12 Aug 2025
CVE-2025-3892 CVE record

CVSS 6.7 Medium

Execution with unnecessary privileges in Axis Communications AB AXIS OS
- Axis Communications AB AXIS OS
- Privilege escalation
Not analysed yet 12 Aug 2025
CVE-2025-0358 CVE record

CVSS 8.8 High

Improper privilege management in Axis Communications AB AXIS OS
- Axis Communications AB AXIS OS
- Privilege escalation
Not analysed yet 2 Jun 2025
CVE-2025-0325 CVE record

CVSS 4.3 Medium

A Guard Tour VAPIX API parameter allowed the use of arbitrary values and can be incorrectly called, allowing an attacker to block access to the guard tour configuration page in the web interface of t…
- Axis Communications AB AXIS OS
- CWE-628
- CWE-1287
Not analysed yet 2 Jun 2025
CVE-2025-0324 CVE record

CVSS 9.4 CriticalCritical · CVSS 9+

The VAPIX Device Configuration framework allowed a privilege escalation, enabling a lower-privileged user to gain administrator privileges.
- Axis Communications AB AXIS OS
- CWE-791
Not analysed yet 2 Jun 2025
CVE-2025-0361 CVE record

CVSS 4.3 Medium

Observable discrepancy in Axis Communications AB AXIS OS
- Axis Communications AB AXIS OS
- Information disclosure
Not analysed yet 8 Apr 2025
CVE-2024-47261 CVE record

CVSS 4.3 Medium

Axis Communications AB AXIS OS: 51l3nc3, a member of the AXIS OS Bug Bounty Program…
- Axis Communications AB AXIS OS
- CWE-1287
Not analysed yet 8 Apr 2025
CVE-2025-0360 CVE record

CVSS 7.8 High

Incorrect authorization in Axis Communications AB AXIS OS
- Axis Communications AB AXIS OS
- Broken access control
Not analysed yet 4 Mar 2025
CVE-2025-0359 CVE record

CVSS 8.5 High

Incorrect authorization in Axis Communications AB AXIS OS
- Axis Communications AB AXIS OS
- Broken access control
Not analysed yet 4 Mar 2025
CVE-2024-47262 CVE record

CVSS 5.3 Medium

Axis Communications AB AXIS OS: Dzmitry Lukyanenka, member of the AXIS OS Bug Bounty Program…
- Axis Communications AB AXIS OS
- CWE-1287
Not analysed yet 4 Mar 2025
CVE-2024-47260 CVE record

CVSS 6.5 Medium

Axis Communications AB AXIS OS: 51l3nc3, member of the AXIS OS Bug Bounty Program…
- Axis Communications AB AXIS OS
- CWE-641
Not analysed yet 4 Mar 2025
CVE-2024-47259 CVE record

CVSS 3.5 Low

Unrestricted file upload in Axis Communications AB AXIS OS
- Axis Communications AB AXIS OS
- Unrestricted file upload
Not analysed yet 4 Mar 2025
CVE-2024-8160 CVE record

CVSS 3.8 Low

Axis Communications AB AXIS OS: Erik de Jong, member of the AXIS OS Bug Bounty Program…
- Axis Communications AB AXIS OS
- CWE-1286
Not analysed yet 26 Nov 2024
CVE-2024-8772 CVE record

CVSS 4.3 Medium

Axis Communications AB AXIS OS: 51l3nc3, member of the AXIS OS Bug Bounty Program…
- Axis Communications AB AXIS OS
- CWE-1286
Not analysed yet 26 Nov 2024
CVE-2024-7784 CVE record

CVSS 6.1 Medium

Stack-based buffer overflow in Axis Communications AB AXIS OS
- Axis Communications AB AXIS OS
- Memory corruption
Not analysed yet 10 Sept 2024
CVE-2024-6979 CVE record

CVSS 6.8 Medium

Incorrect authorization in Axis Communications AB AXIS OS
- Axis Communications AB AXIS OS
- Broken access control
Not analysed yet 10 Sept 2024
CVE-2024-6173 CVE record

CVSS 6.5 Medium

Axis Communications AB AXIS OS: 51l3nc3, member of the AXIS OS Bug Bounty Program…
- Axis Communications AB AXIS OS
- CWE-1286
Not analysed yet 10 Sept 2024
CVE-2024-6509 CVE record

CVSS 6.5 Medium

Resource allocation without limits in Axis Communications AB AXIS OS
- Axis Communications AB AXIS OS
- Denial of service
- CWE-155
Not analysed yet 10 Sept 2024
CVE-2024-0067 CVE record

CVSS 4.3 Medium

Path traversal in Axis Communications AB AXIS OS
- Axis Communications AB AXIS OS
- Path traversal
Not analysed yet 10 Sept 2024
CVE-2024-0066 CVE record

CVSS 5.3 Medium

Cleartext transmission of sensitive information in Axis Communications AB AXIS OS
- Axis Communications AB AXIS OS
- Weak cryptography or TLS
Not analysed yet 18 Jun 2024
CVE-2024-0055 CVE record

CVSS 6.5 Medium

Axis Communications AB AXIS OS: Sandro Poppi, member of the AXIS OS Bug Bounty Program…
- Axis Communications AB AXIS OS
- CWE-155
Not analysed yet 19 Mar 2024
CVE-2024-0054 CVE record

CVSS 6.5 Medium

Axis Communications AB AXIS OS: Sandro Poppi, member of the AXIS OS Bug Bounty Program…
- Axis Communications AB AXIS OS
- CWE-155
Not analysed yet 19 Mar 2024
CVE-2023-5800 CVE record

CVSS 5.4 Medium

Insufficient input validation in VAPIX API create_overlay.cgi
- Axis Communications AB AXIS OS
- Path traversal
Not analysed yet 5 Feb 2024
CVE-2023-5677 CVE record

CVSS 6.3 Medium

OS command injection in Axis Communications AB AXIS OS
- Axis Communications AB AXIS OS
- Command injection
Not analysed yet 5 Feb 2024
CVE-2023-5553 CVE record

CVSS 7.6 High

Incorrect authorization in Axis Communications AB AXIS OS
- Axis Communications AB AXIS OS
- Broken access control
Not analysed yet 21 Nov 2023
CVE-2023-21418 CVE record

CVSS 7.1 High

Path traversal in Axis Communications AB AXIS OS
- Axis Communications AB AXIS OS
- Path traversal
Not analysed yet 21 Nov 2023
CVE-2023-21417 CVE record

CVSS 7.1 High

Path traversal in Axis Communications AB AXIS OS
- Axis Communications AB AXIS OS
- Path traversal
Not analysed yet 21 Nov 2023
CVE-2023-21416 CVE record

CVSS 7.1 High

Path traversal in Axis Communications AB AXIS OS
- Axis Communications AB AXIS OS
- Path traversal
Not analysed yet 21 Nov 2023
CVE-2023-21415 CVE record

CVSS 6.5 Medium

Path traversal in Axis Communications AB AXIS OS
- Axis Communications AB AXIS OS
- Path traversal
Not analysed yet 16 Oct 2023
CVE-2023-21414 CVE record

CVSS 7.1 High

Stack-based buffer overflow in Axis Communications AB AXIS OS and others
- Axis Communications AB AXIS OS
- Axis Communications AB AXIS A8207-VE Mk II
- Memory corruption
Not analysed yet 16 Oct 2023
CVE-2023-21413 CVE record

CVSS 9.1 CriticalCritical · CVSS 9+

Remote code execution vulnerability during the installation of ACAP applications on the Axis device
- Axis Communications AB AXIS OS
- Command injection
Not analysed yet 16 Oct 2023
CVE-2023-21404 CVE record

CVSS 4.1 Medium

Hard-coded cryptographic key in Axis Communications AB AXIS OS
- Axis Communications AB AXIS OS
- Hard-coded credentials
Not analysed yet 8 May 2023
CVE-2021-31988 CVE record

A user controlled parameter related to SMTP test functionality is not correctly validated making it possible to add the Carriage Return and Line Feed (CRLF) control characters and include arbitrary S…
- Axis Communications AB AXIS OS
- CWE-1286
Not analysed yet 5 Oct 2021
CVE-2021-31987 CVE record

A user controlled parameter related to SMTP test functionality is not correctly validated making it possible to bypass blocked network recipients.
- Axis Communications AB AXIS OS
- CWE-1286
Not analysed yet 5 Oct 2021
CVE-2021-31986 CVE record

Heap-based buffer overflow in Axis Communications AB AXIS OS
- Axis Communications AB AXIS OS
- Memory corruption
Not analysed yet 5 Oct 2021