CVE-2023-21417 | BDVDB-2026-217440 Detail

Description#

Sandro Poppi, member of the AXIS OS Bug Bounty Program, has found that the VAPIX API manageoverlayimage.cgi was vulnerable to path traversal attacks that allows for file/folder deletion. This flaw can only be exploited after authenticating with an operator- or administrator- privileged service account. The impact of exploiting this vulnerability is lower with operator service accounts and limited to non-system files compared to administrator-privileges. Axis has released patched AXIS OS versions for the highlighted flaw. Please refer to the Axis security advisory for more information and solution.

Impact#

Weaknesses#

References#

Exploit#

History#

1. Version 12023-11-21Record published in the CVE List.
2. Version 22025-06-11Most recent update recorded in the CVE List.