Axis Communications AXIS OS Unsigned ACAP Application Vulnerability Allowing Arbitrary Code Execution

A vulnerability in Axis Communications AXIS OS versions 12.0.0 through 12.5.35 allows for arbitrary code execution via ACAP applications. The issue arises from insufficient input validation in ACAP configuration files, enabling exploitation if the device is set to permit unsigned ACAP applications and an attacker persuades the user to install a malicious application.

Impact

Exploitation of this vulnerability could lead to unauthorized arbitrary code execution on the affected device.

Remediation

Axis has released a patch for this vulnerability in AXIS OS Active Track 12.5.36. Devices not included in this track but still under support will receive a patch according to their planned maintenance and release schedule. It is recommended to update the Axis device software to the latest version.