CVE-2023-5677: Insufficient input validation in VAPIX API tcptext.cgi
Brandon Rothel from QED Secure Solutions and Sam Hanson of Dragos have found that the VAPIX API tcptest.cgi did not have a sufficient input validation allowing for a possible remote code execution. This flaw can only be exploited after authenticating with an operator- or administrator-privileged service account. The impact of exploiting this vulnerability is lower with operator-privileges compared to administrator-privileges service accounts. Please refer to the Axis security advisory for more information and solution.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2023-5677?
CVE-2023-5677 is classified as a critical vulnerability due to the potential for remote code execution.
How do I fix CVE-2023-5677?
To fix CVE-2023-5677, ensure that the affected Axis firmware is updated to version 5.51.7.7 or later.
What devices are affected by CVE-2023-5677?
CVE-2023-5677 affects various Axis camera models, including M3024-LVE, M3025-VE, M7014, M7016, P1214, P7214, P7216, Q7401, Q7404, Q7414, and Q7424-R MK II.
What is the exploitability of CVE-2023-5677?
CVE-2023-5677 can be exploited only after gaining authentication with an operator or administrator privileges.
What impact does CVE-2023-5677 have?
Exploitation of CVE-2023-5677 could allow an attacker to execute arbitrary code on the affected Axis devices.