CVSS: 8.8EPSS: 0%CPEs: 2EXPL: 0CVE-2023-21406 – Heap-based buffer overflow in Axis A1001 Network Door Controller's OSDP communication
https://notcve.org/view.php?id=CVE-2023-21406
Ariel Harush and Roy Hodir from OTORIO have found a flaw in the AXIS A1001 when communicating over OSDP. A heap-based buffer overflow was found in the pacsiod process which is handling the OSDP communication allowing to write outside of the allocated buffer. By appending invalid data to an OSDP message it was possible to write data beyond the heap allocated buffer. The data written outside the buffer could be used to execute arbitrary code. lease refer to the Axis security advisory for more information, mitigation and affected products and software versions. • https://www.axis.com/dam/public/1b/21/5f/cve-2023-21406-en-US-407245.pdf • CWE-787: Out-of-bounds Write •
CVSS: 6.5EPSS: 0%CPEs: 17EXPL: 0CVE-2023-21405 – Denial-of-Service vulnerability in Axis Network Door Controller's and Axis Network Intercom's OSDP communication
https://notcve.org/view.php?id=CVE-2023-21405
Knud from Fraktal.fi has found a flaw in some Axis Network Door Controllers and Axis Network Intercoms when communicating over OSDP, highlighting that the OSDP message parser crashes the pacsiod process, causing a temporary unavailability of the door-controlling functionalities meaning that doors cannot be opened or closed. No sensitive or customer data can be extracted as the Axis device is not further compromised. Please refer to the Axis security advisory for more information, mitigation and affected products and software versions. • https://www.axis.com/dam/public/7f/3a/ed/cve-2023-21405-en-US-407244.pdf •
CVSS: 10.0EPSS: 10%CPEs: 780EXPL: 2CVE-2018-10661 – Axis Network Camera - .srv to parhand Remote Code Execution
https://notcve.org/view.php?id=CVE-2018-10661
An issue was discovered in multiple models of Axis IP Cameras. There is a bypass of access control. Se ha descubierto un problema en múltiples modelos de las cámaras IP Axis. Existe una omisión de control de acceso. Axis Cameras suffer from authorization bypass, unrestricted dbus access, command injection, denial of service, and information disclosure vulnerabilities. • https://www.exploit-db.com/exploits/45100 https://blog.vdoo.com/2018/06/18/vdoo-discovers-significant-vulnerabilities-in-axis-cameras https://www.axis.com/files/faq/Advisory_ACV-128401.pdf https://www.axis.com/files/sales/ACV-128401_Affected_Product_List.pdf •
CVSS: 7.5EPSS: 0%CPEs: 780EXPL: 1CVE-2018-10659 – Axis Cameras Authorization Bypass / Unrestricted Access / Command Injection
https://notcve.org/view.php?id=CVE-2018-10659
There was a Memory Corruption issue discovered in multiple models of Axis IP Cameras which allows remote attackers to cause a denial of service (crash) by sending a crafted command which will result in a code path that calls the UND undefined ARM instruction. Se ha descubierto un problema de corrupción de memoria en múltiples modelos de las cámaras IP Axis que provoca una denegación de servicio (cierre inesperado) mediante el envío de un comando manipulado, lo que provoca que una ruta de código llame a la instrucción ARM UND indefinida. Axis Cameras suffer from authorization bypass, unrestricted dbus access, command injection, denial of service, and information disclosure vulnerabilities. • https://blog.vdoo.com/2018/06/18/vdoo-discovers-significant-vulnerabilities-in-axis-cameras https://www.axis.com/files/faq/Advisory_ACV-128401.pdf https://www.axis.com/files/sales/ACV-128401_Affected_Product_List.pdf • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 7.5EPSS: 1%CPEs: 780EXPL: 1CVE-2018-10664 – Axis Cameras Authorization Bypass / Unrestricted Access / Command Injection
https://notcve.org/view.php?id=CVE-2018-10664
An issue was discovered in the httpd process in multiple models of Axis IP Cameras. There is Memory Corruption. Se ha descubierto un problema en el proceso httpd en múltiples modelos de las cámaras IP Axis. Existe corrupción de memoria. Axis Cameras suffer from authorization bypass, unrestricted dbus access, command injection, denial of service, and information disclosure vulnerabilities. • https://blog.vdoo.com/2018/06/18/vdoo-discovers-significant-vulnerabilities-in-axis-cameras https://www.axis.com/files/faq/Advisory_ACV-128401.pdf https://www.axis.com/files/sales/ACV-128401_Affected_Product_List.pdf • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •