Axis ACAP Command Injection Vulnerability Leading to Privilege Escalation

A vulnerability exists in Axis devices running AXIS OS versions 12.0.0 through 12.6.39, where an ACAP configuration file has improper permissions. This flaw could allow command injection, potentially leading to privilege escalation. The vulnerability can only be exploited if the device is set to allow the installation of unsigned ACAP applications, and if an attacker persuades a user to install a malicious ACAP application.

Impact

Exploitation of this vulnerability could result in unauthorized command execution and privilege escalation on the affected Axis device.

Remediation

Axis has released a patch for this vulnerability in AXIS OS Active Track 12.6.40. For devices not included in this track but still under support, patches will be provided according to the planned maintenance and release schedule. Users are advised to update their Axis device software to the latest version available.