CVE-2024-0054: Medium severity Axis AXIS OS vulnerability
Sandro Poppi, member of the AXIS OS Bug Bounty Program, has found that the VAPIX APIs locallist.cgi, createoverlay.cgi and irissetup.cgi was vulnerable for file globbing which could lead to a resource exhaustion attack. Axis has released patched AXIS OS versions for the highlighted flaw. Please refer to the Axis security advisory for more information and solution.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-0054?
CVE-2024-0054 is classified as a moderate severity vulnerability impacting Axis AXIS OS.
How do I fix CVE-2024-0054?
To fix CVE-2024-0054, users should upgrade to the patched versions of AXIS OS released by Axis.
What type of attack does CVE-2024-0054 facilitate?
CVE-2024-0054 facilitates a resource exhaustion attack due to the file globbing vulnerability in VAPIX APIs.
Which APIs are affected by CVE-2024-0054?
The affected APIs in CVE-2024-0054 are local_list.cgi, create_overlay.cgi, and irissetup.cgi.
Who discovered CVE-2024-0054?
CVE-2024-0054 was discovered by Sandro Poppi, a member of the AXIS OS Bug Bounty Program.