Axis Communications AXIS Camera Station Pro Insecure Direct Object Reference Vulnerability Allowing Unauthorized Data Modification or Deletion

A vulnerability exists in AXIS Camera Station Pro versions prior to 6.14, allowing non-admin users to modify or delete certain data objects without the necessary permissions. This issue is due to an insecure direct object reference that bypasses authorization controls.

Impact

Exploitation of this vulnerability could lead to unauthorized modification or deletion of data objects by non-admin users.

Remediation

Users are advised to update AXIS Camera Station Pro to version 6.14, where this vulnerability has been addressed. The latest version can be obtained from the Axis Vulnerability Management Portal. For further assistance, contact Axis Technical Support.