Axis Communications AXIS OS Unsigned ACAP Application Vulnerability Allowing Arbitrary Code Execution

A vulnerability in Axis Communications devices running AXIS OS versions 12.0.0 through 12.6.6 allows for arbitrary code execution via improperly validated ACAP configuration files. This issue arises when devices are set to permit the installation of unsigned ACAP applications. An attacker could exploit this vulnerability by persuading a user to install a malicious ACAP application.

Impact

Exploitation of this vulnerability could lead to unauthorized arbitrary code execution on the affected device.

Remediation

Axis has released a patch for this vulnerability in AXIS OS Active Track 12.6.7. Devices not included in this track but still under support will receive a patch according to their planned maintenance and release schedule. It is recommended to update to the latest Axis device software, available through the Axis vulnerability management portal.