Axis Communications AB vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Latest high and critical flaws

• CVE-2026-63286 Database backups are vulnerable to offline attacks.High 7.1 · Oct 28, 2026
• CVE-2026-4757 A VAPIX API parameter had improper input validation which could allow code execution and potentially lead to a privilege escalation.High 7.2 · Aug 11, 2026
• CVE-2025-11547 AXIS Camera Station Pro contained a flaw to perform a privilege escalation attack on the server as a non-admin user.High 7.8 · Feb 10, 2026
• CVE-2025-11142 The VAPIX API mediaclip.cgi that did not have a sufficient input validation allowing for a possible remote code execution.High 7.1 · Feb 10, 2026
• CVE-2025-10714 AXIS Optimizer was vulnerable to an unquoted search path vulnerability, which could potentially lead to privilege escalation within Microsoft Windows operating High 8.4 · Nov 11, 2025
• CVE-2025-30023 The communication protocol used between client and server had a flaw that could lead to an authenticated user performing a remote code execution attack.Critical 9 · Jul 11, 2025
• CVE-2025-0358 During an annual penetration test conducted on behalf of Axis Communication, Truesec discovered a flaw in the VAPIX Device Configuration framework that allowed High 8.8 · Jun 2, 2025
• CVE-2025-0324 The VAPIX Device Configuration framework allowed a privilege escalation, enabling a lower-privileged user to gain administrator privileges.Critical 9.4 · Jun 2, 2025
• CVE-2025-0360 During an annual penetration test conducted on behalf of Axis Communication, Truesec discovered a flaw in the VAPIX Device Configuration framework that could leHigh 7.8 · Mar 4, 2025
• CVE-2025-0359 During an annual penetration test conducted on behalf of Axis Communication, Truesec discovered a flaw in the ACAP Application framework that allowed applicatioHigh 8.5 · Mar 4, 2025
• CVE-2024-47257 Florent Thiéry has found that selected Axis devices were vulnerable to handling certain ethernet frames which could lead to the Axis device becoming unavailableHigh 7.5 · Nov 26, 2024
• CVE-2023-5553 During internal Axis Security Development Model (ASDM) threat-modelling, a flaw was found in the protection for device tampering (commonly known as Secure Boot)High 7.6 · Nov 21, 2023
• CVE-2023-21418 Sandro Poppi, member of the AXIS OS Bug Bounty Program, has found that the VAPIX API irissetup.cgi was vulnerable to path traversal attacks that allows for fileHigh 7.1 · Nov 21, 2023
• CVE-2023-21417 Sandro Poppi, member of the AXIS OS Bug Bounty Program, has found that the VAPIX API manageoverlayimage.cgi was vulnerable to path traversal attacks that allowHigh 7.1 · Nov 21, 2023
• CVE-2023-21416 Sandro Poppi, member of the AXIS OS Bug Bounty Program, has found that the VAPIX API dynamicoverlay.cgi was vulnerable to a Denial-of-Service attack allowing foHigh 7.1 · Nov 21, 2023
• CVE-2023-21414 NCC Group has found a flaw during the annual internal penetration test ordered by Axis Communications.High 7.1 · Oct 16, 2023
• CVE-2023-21413 GoSecure on behalf of Genetec Inc.Critical 9.1 · Oct 16, 2023
• CVE-2023-21412 User provided input is not sanitized on the AXIS License Plate Verifier specific “search.cgi” allowing for SQL injections.High 7.2 · Aug 3, 2023
• CVE-2023-21411 User provided input is not sanitized in the “Settings > Access Control” configuration interface allowing for arbitrary code execution.High 7.2 · Aug 3, 2023
• CVE-2023-21410 User provided input is not sanitized on the AXIS License Plate Verifier specific “api.cgi” allowing for arbitrary code execution.High 7.2 · Aug 3, 2023
• CVE-2023-21409 Due to insufficient file permissions, unprivileged users could gain access to unencrypted administrator credentials allowing the configuration of the applicatiHigh 8.4 · Aug 3, 2023
• CVE-2023-21408 Due to insufficient file permissions, unprivileged users could gain access to unencrypted user credentials that are used in the integration interface towards 3High 8.4 · Aug 3, 2023
• CVE-2023-21407 A broken access control was found allowing for privileged escalation of the operator account to gain administrator privileges.High 8.8 · Aug 3, 2023
• CVE-2023-21406 Ariel Harush and Roy Hodir from OTORIO have found a flaw in the AXIS A1001 when communicating over OSDP.High 7.1 · Jul 25, 2023
• CVE-2022-23410 AXIS IP Utility before 4.18.0 allows for remote code execution and local privilege escalation by the means of DLL hijacking.High 7.8 · Feb 14, 2022