Axis Products Remote Code Execution Vulnerability via Flawed Communication Protocol

A remote code execution vulnerability has been identified in several Axis products, including AXIS Camera Station Pro versions prior to 6.9, AXIS Camera Station versions prior to 5.58, and AXIS Device Manager versions prior to 5.32. The vulnerability arises from a flaw in the communication protocol between client and server, allowing an authenticated user to execute arbitrary code on the server.

Impact

Exploitation of this vulnerability allows for remote code execution on the affected system.

Remediation

Axis has released patches for this vulnerability. Users are advised to update to AXIS Camera Station Pro 6.9, AXIS Camera Station 5.58, or AXIS Device Manager 5.32. The latest versions can be found on the Axis website or through Axis Technical Support.