Seth Fogie, member of AXIS Camera Station Pro Bug Bounty Program, has found that it is…
Priority LOW 28CWE-117Published · Updated
Key facts
- Attack vector
- Adjacent network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- None · Low · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA.
Summary
Seth Fogie, member of AXIS Camera Station Pro Bug Bounty Program, has found that it is possible for an authenticated malicious client to tamper with audit log creation in AXIS Camera Station, or perform a Denial-of-Service attack on the AXIS Camera Station server using maliciously crafted audit log entries. Axis has released a patched version for the highlighted flaw. Please refer to the Axis security advisory for more information and solution.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00235 14th percentileScored 2026-11-07
Fix Fixed AXIS Camera Station Pro (Axis Communications AB): 6.5
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Axis Communications AB | AXIS Camera Station Pro | before 6.5 | 6.5 | Patch available | CNA |
- AXIS Camera Station Pro VendorAxis Communications AB Affected before 6.5 Fixed in 6.5 Patch available CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:axis:camera_station_pro:*:*:*:*:*:*:*:* | before 6.5.35848 | Vulnerable | Axis Communications AB |
- cpe:2.3:a:axis:camera_station_pro:*:*:*:*:*:*:*:* Versions before 6.5.35848 Vulnerable ·Axis Communications AB
Remediation
- Fix · CNA AXIS Camera Station Pro (Axis Communications AB) Fixed in 6.5
Timeline
- 2026-10-02 Threatist record created from CVE-2024-7696
- 2026-10-03 Alias added: GHSA-8q9f-gmmq-64wc
References
More Axis Communications AB Camera Station Pro vulnerabilities
- TI-2025-21395 Deserialization of untrusted data in AXIS Camera Station Pro CVSS 3.1CRITICAL 9.0
- TI-2025-10582 AXIS Camera Station Pro contained a flaw to perform a privilege escalation attack on the server as a non-admin user. CVSS 3.1HIGH 7.8
- TI-2025-00785 Incorrect permission assignment in AXIS Camera Station Pro CVSS 3.1HIGH 7.3
- TI-2025-00895 Gee-netics, member of AXIS Camera Station Pro Bug Bounty Program, has identified an issue… CVSS 3.1MEDIUM 6.5
- TI-2025-21398 The AXIS Camera Station Server had a flaw that allowed to bypass authentication that is normally required. CVSS 4.0MEDIUM 5.3
- TI-2025-11061 Authorization bypass in AXIS Camera Station Pro CVSS 3.1MEDIUM 5.7
Sources
- CVE-2024-7696 · CVE Program
- CVE-2024-7696 · NVD
- FIRST EPSS
- GHSA-8q9f-gmmq-64wc · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences