Axis Communications AXIS OS ACAP Framework D-Bus Access Vulnerability

A vulnerability has been identified in the ACAP Application framework of Axis OS versions 11.11 prior to 12.1. This flaw allows applications to access restricted D-Bus methods, potentially leading to unauthorized actions within the framework. The vulnerability was discovered during a penetration test by Truesec.

Impact

Exploitation of this vulnerability could allow applications to bypass authorization and access restricted D-Bus methods, potentially leading to unauthorized actions or access within the ACAP Application framework.

Remediation

Axis has released patches for this vulnerability in AXIS OS Active Track 12.2.52 and LTS 2024 11.11.135. For devices not included in these tracks but still under support, patches will be provided according to the planned maintenance and release schedule. Users are advised to update their Axis device software to the latest version available.