https://www.axis.com/dam/public/a9/dd/f1/cve-2023-5677-en-US-424335.pdf

Brandon
Rothel from QED Secure Solutions has found that the VAPIX API tcptest.cgi
did not have a sufficient input validation allowing for a possible remote code
execution. This flaw can only be exploited after authenticating with an
operator- or administrator-privileged service account. The impact of exploiting
this vulnerability is lower with operator-privileges compared to
administrator-privileges service accounts. Axis has released patched AXIS OS
versions for the highlighted flaw. Please ref

Brandon
Rothel from QED Secure Solutions has found that the VAPIX API tcptest.cgi
did not have a sufficient input validation allowing for a possible remote code
execution. This flaw can only be exploited after authenticating with an
operator- or administrator-privileged service account. The impact of exploiting
this vulnerability is lower with operator-privileges compared to
administrator-privileges service accounts. Axis has released patched AXIS OS
versions for the highlighted flaw. Please ref

Axis Communications AB CWE-78

NIST AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

NIST CWE-94

AND
     OR
          *cpe:2.3:o:axis:m3024-lve_firmware:*:*:*:*:*:*:*:* versions up to (excluding) 5.51.7.7
     OR
          cpe:2.3:h:axis:m3024-lve:-:*:*:*:*:*:*:*

AND
     OR
          *cpe:2.3:o:axis:m3025-ve_firmware:*:*:*:*:*:*:*:* versions up to (excluding) 5.51.7.7
     OR
          cpe:2.3:h:axis:m3025-ve:-:*:*:*:*:*:*:*

AND
     OR
          *cpe:2.3:o:axis:m7014_firmware:*:*:*:*:*:*:*:* versions up to (excluding) 5.51.7.7
     OR
          cpe:2.3:h:axis:m7014:-:*:*:*:*:*:*:*

AND
     OR
          *cpe:2.3:o:axis:m7016_firmware:*:*:*:*:*:*:*:* versions up to (excluding) 5.51.7.7
     OR
          cpe:2.3:h:axis:m7016:-:*:*:*:*:*:*:*

AND
     OR
          *cpe:2.3:o:axis:p1214-e_firmware:*:*:*:*:*:*:*:* versions up to (excluding) 5.51.7.7
     OR
          cpe:2.3:h:axis:p1214-e:-:*:*:*:*:*:*:*

AND
     OR
          *cpe:2.3:o:axis:p7214_firmware:*:*:*:*:*:*:*:* versions up to (excluding) 5.51.7.7
     OR
          cpe:2.3:h:axis:p7214:-:*:*:*:*:*:*:*

AND
     OR
          *cpe:2.3:o:axis:p7216_firmware:*:*:*:*:*:*:*:* versions up to (excluding) 5.51.7.7
     OR
          cpe:2.3:h:axis:p7216:-:*:*:*:*:*:*:*

AND
     OR
          *cpe:2.3:o:axis:q7401_firmware:*:*:*:*:*:*:*:* versions up to (excluding) 5.51.7.7
     OR
          cpe:2.3:h:axis:q7401:-:*:*:*:*:*:*:*

AND
     OR
          *cpe:2.3:o:axis:q7404_firmware:*:*:*:*:*:*:*:* versions up to (excluding) 5.51.7.7
     OR
          cpe:2.3:h:axis:q7404:-:*:*:*:*:*:*:*

AND
     OR
          *cpe:2.3:o:axis:q7414_firmware:*:*:*:*:*:*:*:* versions up to (excluding) 5.51.7.7
     OR
          cpe:2.3:h:axis:q7414:-:*:*:*:*:*:*:*

AND
     OR
          *cpe:2.3:o:axis:q7424-r_mk_ii_firmware:*:*:*:*:*:*:*:* versions up to (excluding) 5.51.3.9
     OR
          cpe:2.3:h:axis:q7424-r_mk_ii:-:*:*:*:*:*:*:*

https://www.axis.com/dam/public/a9/dd/f1/cve-2023-5677-en-US-424335.pdf No Types Assigned

https://www.axis.com/dam/public/a9/dd/f1/cve-2023-5677-en-US-424335.pdf Vendor Advisory

Brandon
Rothel from QED Secure Solutions has found that the VAPIX API tcptest.cgi
did not have a sufficient input validation allowing for a possible remote code
execution. This flaw can only be exploited after authenticating with an
operator- or administrator-privileged service account. The impact of exploiting
this vulnerability is lower with operator-privileges compared to
administrator-privileges service accounts. Axis has released patched AXIS OS
versions for the highlighted flaw. Please ref

Axis Communications AB AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Axis Communications AB https://www.axis.com/dam/public/a9/dd/f1/cve-2023-5677-en-US-424335.pdf [No types assigned]