# cve.now: Axis Communications AB

The newest entries naming Axis Communications AB as an affected vendor (up to 200), of 100 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-63287](https://cve.now/CVE-2026-63287.md): It was possible for an authenticated non-admin user to modify certain data objects without having the appropriate permissions, which could… (CVSS 6.5)
- [CVE-2026-13387](https://cve.now/CVE-2026-13387.md): A vulnerability related to URL redirection handling during the sign-out flow that could allow a user to be redirected to unintended… (CVSS 3.5)
- [CVE-2026-13312](https://cve.now/CVE-2026-13312.md): A vulnerability that could allow an attacker to compromise a system. (CVSS 9.9)
- [CVE-2026-12964](https://cve.now/CVE-2026-12964.md): A vulnerability allowing for privileged escalation of the viewer account to gain administrator privileges. (CVSS 8.0)
- [CVE-2026-12963](https://cve.now/CVE-2026-12963.md): A vulnerability that could allow a viewer account to gain unauthorized access to network attached storage devices on the server. (CVSS 7.4)
- [CVE-2026-12389](https://cve.now/CVE-2026-12389.md): A vulnerability that could lead to a high privileged authenticated user performing a remote code execution attack. (CVSS 8.4)
- [CVE-2026-8372](https://cve.now/CVE-2026-8372.md): A vulnerability that could allow an attacker to gain unauthorized access. (CVSS 8.8)
- [CVE-2026-4762](https://cve.now/CVE-2026-4762.md): A vulnerability to perform a privilege escalation attack on the server as a non-admin user. (CVSS 8.8)
- [CVE-2026-63288](https://cve.now/CVE-2026-63288.md): A WebSocket request sent to a specific API endpoint allows unauthorized access to a separate API endpoint. (CVSS 8.3)
- [CVE-2026-14918](https://cve.now/CVE-2026-14918.md): The Signed Video Framework contained a out-of-bounds read issue in the Signed Video Framework which could lead the application using this… (CVSS 5.3)
- [CVE-2026-63282](https://cve.now/CVE-2026-63282.md): Improper shell quote escaping when processing user-controlled input, potentially allowing command injection, which could lead to privilege… (CVSS 6.5)
- [CVE-2026-14543](https://cve.now/CVE-2026-14543.md): The VAPIX Edge storage API, enabling the escalation of user privileges by circumventing filesystem isolation, granting unauthorized access… (CVSS 3.9)
- [CVE-2026-14542](https://cve.now/CVE-2026-14542.md): The VAPIX SIP configuration API lacked sufficient input validation, which could potentially lead to privilege escalation. (CVSS 6.7)
- [CVE-2026-13409](https://cve.now/CVE-2026-13409.md): The VAPIX API dynamicoverlay.cgi which results in a Denial-of-Service of the overlay functionality. (CVSS 4.3)
- [CVE-2026-9063](https://cve.now/CVE-2026-9063.md): A locally authenticated user can achieve privilege escalation via an insecure configuration that leads to unauthorized code execution. (CVSS 6.7)
- [CVE-2026-63286](https://cve.now/CVE-2026-63286.md): Database backups are vulnerable to offline attacks. (CVSS 7.1)
- [CVE-2026-4757](https://cve.now/CVE-2026-4757.md): A VAPIX API parameter had improper input validation which could allow code execution and potentially lead to a privilege escalation. (CVSS 7.2)
- [CVE-2026-6505](https://cve.now/CVE-2026-6505.md): The ACAP framework contains a Time-of-Check to Time-of-Use (TOCTOU) race condition, which could potentially lead to privilege escalation. (CVSS 5.1)
- [CVE-2026-5304](https://cve.now/CVE-2026-5304.md): An ACAP configuration file lacks input validation, which could potentially lead to privilege escalation. (CVSS 5.7)
- [CVE-2026-5303](https://cve.now/CVE-2026-5303.md): The ACAP framework contains a Time-of-Check to Time-of-Use (TOCTOU) race condition, which could potentially lead to privilege escalation. (CVSS 5.7)
- [CVE-2026-8158](https://cve.now/CVE-2026-8158.md): The Signed Video Framework contained a buffer overflow issue which could lead the application using this framework to crash. (CVSS 5.3)
- [CVE-2026-6181](https://cve.now/CVE-2026-6181.md): The Device Configuration Framework is vulnerable to an authentication bypass flaw. (CVSS 5.9)
- [CVE-2026-1185](https://cve.now/CVE-2026-1185.md): A configuration file on the local file system had improper input validation which could allow code execution and potentially lead to privile (CVSS 5.4)
- [CVE-2026-0804](https://cve.now/CVE-2026-0804.md): An ACAP configuration file lacked sufficient input validation, which could allow a path traversal attack leading to potential privilege esca (CVSS 6.7)
- [CVE-2026-0802](https://cve.now/CVE-2026-0802.md): An ACAP configuration file lacked sufficient input validation, which could allow command injection and potentially lead to privilege escalat (CVSS 6.0)
- [CVE-2026-0541](https://cve.now/CVE-2026-0541.md): ACAP applications can gain elevated privileges due to improper input validation during the installation process, potentially leading to priv (CVSS 6.7)
- [CVE-2025-12063](https://cve.now/CVE-2025-12063.md): An insecure direct object reference allowed a non-admin user to modify or remove certain data objects without having the appropriate permiss (CVSS 5.7)
- [CVE-2025-12757](https://cve.now/CVE-2025-12757.md): An AXIS Camera Station Pro feature can be exploited in a way that allows a non-admin user to view information they are not permitted to. (CVSS 4.6)
- [CVE-2025-13064](https://cve.now/CVE-2025-13064.md): A server-side injection was possible for a malicious admin to manipulate the application to include a malicious script which is executed by (CVSS 4.5)
- [CVE-2025-11547](https://cve.now/CVE-2025-11547.md): AXIS Camera Station Pro contained a flaw to perform a privilege escalation attack on the server as a non-admin user. (CVSS 7.8)
- [CVE-2025-11142](https://cve.now/CVE-2025-11142.md): The VAPIX API mediaclip.cgi that did not have a sufficient input validation allowing for a possible remote code execution. (CVSS 7.1)
- [CVE-2025-9055](https://cve.now/CVE-2025-9055.md): The VAPIX Edge storage API that allowed a privilege escalation, enabling a VAPIX administrator-privileged user to gain Linux Root privileges (CVSS 6.4)
- [CVE-2025-8998](https://cve.now/CVE-2025-8998.md): It was possible to upload files with a specific name to a temporary directory, which may result in process crashes and impact usability. (CVSS 3.1)
- [CVE-2025-9524](https://cve.now/CVE-2025-9524.md): The VAPIX API port.cgi did not have sufficient input validation, which may result in process crashes and impact usability. (CVSS 4.3)
- [CVE-2025-10714](https://cve.now/CVE-2025-10714.md): AXIS Optimizer was vulnerable to an unquoted search path vulnerability, which could potentially lead to privilege escalation within Microsof (CVSS 8.4)
- [CVE-2025-8108](https://cve.now/CVE-2025-8108.md): An ACAP configuration file has improper permissions and lacks input validation, which could potentially lead to privilege escalation. (CVSS 6.7)
- [CVE-2025-6779](https://cve.now/CVE-2025-6779.md): An ACAP configuration file has improper permissions, which could allow command injection and potentially lead to privilege escalation. (CVSS 6.7)
- [CVE-2025-6571](https://cve.now/CVE-2025-6571.md): A 3rd-party component exposed its password in process arguments, allowing for low-privileged users to access it. (CVSS 6.0)
- [CVE-2025-5452](https://cve.now/CVE-2025-5452.md): A malicious ACAP application can gain access to admin-level service account credentials used by legitimate ACAP applications, leading to pot (CVSS 6.6)
- [CVE-2025-6298](https://cve.now/CVE-2025-6298.md): ACAP applications can gain elevated privileges due to improper input validation, potentially leading to privilege escalation. (CVSS 6.7)
- [CVE-2025-5718](https://cve.now/CVE-2025-5718.md): The ACAP Application framework could allow privilege escalation through a symlink attack. (CVSS 6.8)
- [CVE-2025-5454](https://cve.now/CVE-2025-5454.md): An ACAP configuration file lacked sufficient input validation, which could allow a path traversal attack leading to potential privilege esca (CVSS 6.4)
- [CVE-2025-4645](https://cve.now/CVE-2025-4645.md): An ACAP configuration file lacked sufficient input validation, which could allow for arbitrary code execution. (CVSS 6.7)
- [CVE-2025-30027](https://cve.now/CVE-2025-30027.md): An ACAP configuration file lacked sufficient input validation, which could allow for arbitrary code execution. (CVSS 6.7)
- [CVE-2025-3892](https://cve.now/CVE-2025-3892.md): ACAP applications can be executed with elevated privileges, potentially leading to privilege escalation. (CVSS 6.7)
- [CVE-2025-7622](https://cve.now/CVE-2025-7622.md): During an internal security assessment, a Server-Side Request Forgery (SSRF) vulnerability that allowed an authenticated attacker to access (CVSS 5.1)
- [CVE-2025-30026](https://cve.now/CVE-2025-30026.md): The AXIS Camera Station Server had a flaw that allowed to bypass authentication that is normally required. (CVSS 5.3)
- [CVE-2025-30025](https://cve.now/CVE-2025-30025.md): The communication protocol used between the server process and the service control had a flaw that could lead to a local privilege escalatio (CVSS 4.8)
- [CVE-2025-30024](https://cve.now/CVE-2025-30024.md): The communication protocol used between client and server had a flaw that could be leveraged to execute a man in the middle attack. (CVSS 6.8)
- [CVE-2025-30023](https://cve.now/CVE-2025-30023.md): The communication protocol used between client and server had a flaw that could lead to an authenticated user performing a remote code execu (CVSS 9.0)
- [CVE-2025-0358](https://cve.now/CVE-2025-0358.md): During an annual penetration test conducted on behalf of Axis Communication, Truesec discovered a flaw in the VAPIX Device Configuration fra (CVSS 8.8)
- [CVE-2025-0325](https://cve.now/CVE-2025-0325.md): A Guard Tour VAPIX API parameter allowed the use of arbitrary values and can be incorrectly called, allowing an attacker to block access to (CVSS 4.3)
- [CVE-2025-0324](https://cve.now/CVE-2025-0324.md): The VAPIX Device Configuration framework allowed a privilege escalation, enabling a lower-privileged user to gain administrator privileges. (CVSS 9.4)
- [CVE-2025-0926](https://cve.now/CVE-2025-0926.md): Gee-netics, member of AXIS Camera Station Pro Bug Bounty Program, has found that it is possible for a non-admin user to remove system files (CVSS 5.9)
- [CVE-2025-1056](https://cve.now/CVE-2025-1056.md): Gee-netics, member of AXIS Camera Station Pro Bug Bounty Program, has identified an issue with a specific file that the server is using. (CVSS 6.1)
- [CVE-2025-0361](https://cve.now/CVE-2025-0361.md): During an annual penetration test conducted on behalf of Axis Communications, Truesec discovered a flaw in the VAPIX Device Configuration fr (CVSS 4.3)
- [CVE-2024-47261](https://cve.now/CVE-2024-47261.md): 51l3nc3, a member of the AXIS OS Bug Bounty Program, has found that the VAPIX API uploadoverlayimage.cgi did not have sufficient input valid (CVSS 4.3)
- [CVE-2025-0360](https://cve.now/CVE-2025-0360.md): During an annual penetration test conducted on behalf of Axis Communication, Truesec discovered a flaw in the VAPIX Device Configuration fra (CVSS 7.8)
- [CVE-2025-0359](https://cve.now/CVE-2025-0359.md): During an annual penetration test conducted on behalf of Axis Communication, Truesec discovered a flaw in the ACAP Application framework tha (CVSS 8.5)
- [CVE-2024-47262](https://cve.now/CVE-2024-47262.md): Dzmitry Lukyanenka, member of the AXIS OS Bug Bounty Program, has found that the VAPIX API param.cgi was vulnerable to a race condition atta (CVSS 5.3)
- [CVE-2024-47260](https://cve.now/CVE-2024-47260.md): 51l3nc3, member of the AXIS OS Bug Bounty Program, has found that the VAPIX API mediaclip.cgi did not have a sufficient input validation all (CVSS 6.5)
- [CVE-2024-47259](https://cve.now/CVE-2024-47259.md): Girishunawane, member of the AXIS OS Bug Bounty Program, has found that the VAPIX API dynamicoverlay.cgi did not have a sufficient input val (CVSS 3.5)
- [CVE-2024-7696](https://cve.now/CVE-2024-7696.md): Seth Fogie, member of AXIS Camera Station Pro Bug Bounty Program, has found that it is possible for an authenticated malicious client to tam (CVSS 6.3)
- [CVE-2024-8160](https://cve.now/CVE-2024-8160.md): Erik de Jong, member of the AXIS OS Bug Bounty Program, has found that the VAPIX API ftptest.cgi did not have a sufficient input validation (CVSS 3.8)
- [CVE-2024-8772](https://cve.now/CVE-2024-8772.md): 51l3nc3, member of the AXIS OS Bug Bounty Program, has found that the VAPIX API managedoverlayimages.cgi was vulnerable to a race condition (CVSS 4.3)
- [CVE-2024-47257](https://cve.now/CVE-2024-47257.md): Florent Thiéry has found that selected Axis devices were vulnerable to handling certain ethernet frames which could lead to the Axis device (CVSS 7.5)
- [CVE-2024-6831](https://cve.now/CVE-2024-6831.md): Seth Fogie, member of AXIS Camera Station Pro Bug Bounty Program has found that it is possible to edit and/or remove views without the neces (CVSS 4.4)
- [CVE-2024-6749](https://cve.now/CVE-2024-6749.md): Seth Fogie, member of the AXIS Camera Station Pro Bug Bounty Program, has found that the Incident report feature may expose sensitive creden (CVSS 6.3)
- [CVE-2024-6476](https://cve.now/CVE-2024-6476.md): Gee-netics, member of the AXIS Camera Station Pro Bug Bounty Program has found that it is possible for a non-admin user to gain system privi (CVSS 4.2)
- [CVE-2024-7784](https://cve.now/CVE-2024-7784.md): During internal Axis Security Development Model (ASDM) threat-modelling, a flaw was found in the protection for device tampering (commonly k (CVSS 6.1)
- [CVE-2024-6979](https://cve.now/CVE-2024-6979.md): Amin Aliakbari, member of the AXIS OS Bug Bounty Program, has found a broken access control which would lead to less-privileged operator- an (CVSS 6.8)
- [CVE-2024-6173](https://cve.now/CVE-2024-6173.md): 51l3nc3, member of the AXIS OS Bug Bounty Program, has found that a Guard Tour VAPIX API parameter allowed the use of arbitrary values allow (CVSS 6.5)
- [CVE-2024-6509](https://cve.now/CVE-2024-6509.md): Marinus Pfund, member of the AXIS OS Bug Bounty Program, has found the VAPIX API alwaysmulti.cgi was vulnerable for file globbing which cou (CVSS 6.5)
- [CVE-2024-0067](https://cve.now/CVE-2024-0067.md): Marinus Pfund, member of the AXIS OS Bug Bounty Program, has found the VAPIX API ledlimit.cgi was vulnerable for path traversal attacks all (CVSS 4.3)
- [CVE-2024-0066](https://cve.now/CVE-2024-0066.md): Johan Fagerström, member of the AXIS OS Bug Bounty Program, has found that a O3C feature may expose sensitive traffic between the client (Ax (CVSS 5.3)
- [CVE-2024-0055](https://cve.now/CVE-2024-0055.md): Sandro Poppi, member of the AXIS OS Bug Bounty Program, has found that the VAPIX APIs mediaclip.cgi and playclip.cgi was vulnerable for file (CVSS 6.5)
- [CVE-2024-0054](https://cve.now/CVE-2024-0054.md): Sandro Poppi, member of the AXIS OS Bug Bounty Program, has found that the VAPIX APIs local\_list.cgi, create\_overlay.cgi and irissetup.cgi w (CVSS 6.5)
- [CVE-2023-5800](https://cve.now/CVE-2023-5800.md): Insufficient input validation in VAPIX API create\_overlay.cgi (CVSS 5.4)
- [CVE-2023-5677](https://cve.now/CVE-2023-5677.md): Brandon Rothel from QED Secure Solutions and Sam Hanson of Dragos have found that the VAPIX API tcptest.cgi did not have a sufficient input (CVSS 6.3)
- [CVE-2023-5553](https://cve.now/CVE-2023-5553.md): During internal Axis Security Development Model (ASDM) threat-modelling, a flaw was found in the protection for device tampering (commonly k (CVSS 7.6)
- [CVE-2023-21418](https://cve.now/CVE-2023-21418.md): Sandro Poppi, member of the AXIS OS Bug Bounty Program, has found that the VAPIX API irissetup.cgi was vulnerable to path traversal attacks (CVSS 7.1)
- [CVE-2023-21417](https://cve.now/CVE-2023-21417.md): Sandro Poppi, member of the AXIS OS Bug Bounty Program, has found that the VAPIX API manageoverlayimage.cgi was vulnerable to path traversa (CVSS 7.1)
- [CVE-2023-21416](https://cve.now/CVE-2023-21416.md): Sandro Poppi, member of the AXIS OS Bug Bounty Program, has found that the VAPIX API dynamicoverlay.cgi was vulnerable to a Denial-of-Servic (CVSS 7.1)
- [CVE-2023-21415](https://cve.now/CVE-2023-21415.md): Sandro Poppi, member of the AXIS OS Bug Bounty Program, has found that the VAPIX API overlay\_del.cgi is vulnerable to path traversal attacks (CVSS 6.5)
- [CVE-2023-21414](https://cve.now/CVE-2023-21414.md): NCC Group has found a flaw during the annual internal penetration test ordered by Axis Communications. (CVSS 7.1)
- [CVE-2023-21413](https://cve.now/CVE-2023-21413.md): Remote code execution vulnerability during the installation of ACAP applications on the Axis device (CVSS 9.1)
- [CVE-2023-21412](https://cve.now/CVE-2023-21412.md): Non-sanitized user input could lead to SQL injections in AXIS License Plate Verifier (CVSS 7.2)
- [CVE-2023-21411](https://cve.now/CVE-2023-21411.md): Non-sanitized user input could lead to arbitrary code execution during Access Control configuration in AXIS License Plate Verifier (CVSS 7.2)
- [CVE-2023-21410](https://cve.now/CVE-2023-21410.md): Non-sanitized user input could lead to arbitrary code execution in AXIS License Plate Verifier (CVSS 7.2)
- [CVE-2023-21409](https://cve.now/CVE-2023-21409.md): Insufficient file permissions leak administrator-privileged credentials in AXIS License Verifier ACAP (CVSS 8.4)
- [CVE-2023-21408](https://cve.now/CVE-2023-21408.md): Insufficient file permissions leak user credentials of 3rd party integration interfaces in AXIS License Verifier ACAP (CVSS 8.4)
- [CVE-2023-21407](https://cve.now/CVE-2023-21407.md): Privilege escalation in AXIS License Plate Verifier ACAP (CVSS 8.8)
- [CVE-2023-21406](https://cve.now/CVE-2023-21406.md): Heap-based buffer overflow in Axis A1001 Network Door Controller's OSDP communication (CVSS 7.1)
- [CVE-2023-21405](https://cve.now/CVE-2023-21405.md): Denial-of-Service vulnerability in Axis Network Door Controller's and Axis Network Intercom's OSDP communication (CVSS 6.5)
- [CVE-2023-21404](https://cve.now/CVE-2023-21404.md): AXIS OS 11.0.X - 11.3.x use a static RSA key in legacy LUA-components to protect Axis-specific source code. (CVSS 4.1)
- [CVE-2022-23410](https://cve.now/CVE-2022-23410.md): AXIS IP Utility before 4.18.0 allows for remote code execution and local privilege escalation by the means of DLL hijacking. (no CVSS)
- [CVE-2021-31988](https://cve.now/CVE-2021-31988.md): A user controlled parameter related to SMTP test functionality is not correctly validated making it possible to add the Carriage Return and (no CVSS)
- [CVE-2021-31987](https://cve.now/CVE-2021-31987.md): A user controlled parameter related to SMTP test functionality is not correctly validated making it possible to bypass blocked network recip (no CVSS)
- [CVE-2021-31986](https://cve.now/CVE-2021-31986.md): User controlled parameters related to SMTP notifications are not correctly validated. (no CVSS)
- [CVE-2021-31989](https://cve.now/CVE-2021-31989.md): A user with permission to log on to the machine hosting the AXIS Device Manager client could under certain conditions extract a memory dump (no CVSS)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/axis-communications
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.