Incorrect authorization in AXIS OS
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- High
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-863.
Summary
Amin Aliakbari, member of the AXIS OS Bug Bounty Program, has found a broken access control which would lead to less-privileged operator- and/or viewer accounts having more privileges than designed. The risk of exploitation is very low as it requires complex steps to execute, including knowing of account passwords and social engineering attacks in tricking the administrator to perform specific configurations on operator- and/or viewer-privileged accounts. Axis has released patched AXIS OS a version for the highlighted flaw. Please refer to the Axis security advisory for more information and solution.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Axis Communications AB | AXIS OS | 11.11.0 to before 11.11.94 | 11.11.94 | Patch available | CNA |
- AXIS OS VendorAxis Communications AB Affected 11.11.0 to before 11.11.94 Fixed in 11.11.94 Patch available CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:axis:axis_os_2024:*:*:*:*:lts:*:*:* | 11.11.0 to before 11.11.94 | Vulnerable | Axis Communications AB |
- cpe:2.3:o:axis:axis_os_2024:*:*:*:*:lts:*:*:* Versions 11.11.0 to before 11.11.94 Vulnerable ·Axis Communications AB
Remediation
- Fix · CNA AXIS OS (Axis Communications AB) Fixed in 11.11.94
Timeline
- 2026-10-02 Threatist record created from CVE-2024-6979
- 2026-10-03 Alias added: GHSA-v4c3-j4px-23w3
References
More Axis Communications AB Axis Os 2024 vulnerabilities
- TI-2025-00260 The VAPIX Device Configuration framework allowed a privilege escalation, enabling a… CVSS 3.1CRITICAL 9.4
- TI-2025-00292 Incorrect authorization in AXIS OS CVSS 3.1HIGH 8.5
- TI-2025-00293 Incorrect authorization in AXIS OS CVSS 3.1HIGH 7.8
- TI-2024-31594 Unrestricted file upload in AXIS OS CVSS 3.1HIGH 7.1
- TI-2025-00294 Observable discrepancy in AXIS OS CVSS 3.1MEDIUM 5.3
- TI-2024-31596 51l3nc3, a member of the AXIS OS Bug Bounty Program, has found that the VAPIX API… CVSS 3.1MEDIUM 4.3
Sources
- CVE-2024-6979 · CVE Program
- CVE-2024-6979 · NVD
- FIRST EPSS
- GHSA-v4c3-j4px-23w3 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences