Read the docs
TI-2024-07217 Aliases CVE-2024-7784GHSA-fmjv-qpc7-997r

Stack-based buffer overflow in AXIS OS

Priority LOW 29CWE-121Published · Updated

Key facts

Attack vector
Physical
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-121 and the CVSS impact.

Summary

During internal Axis Security Development Model (ASDM) threat-modelling, a flaw was found in the protection for device tampering (commonly known as Secure Boot) in AXIS OS making it vulnerable to a sophisticated attack to bypass this protection. To Axis' knowledge, there are no known exploits of the vulnerability at this time. Axis has released patched AXIS OS versions for the highlighted flaw. Please refer to the Axis security advisory for more information and solution.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00238 14th percentileScored 2026-11-07
Fix Fixed AXIS OS (Axis Communications AB): 10.12.246, 11.11.80, 12.0.40 +3

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Axis Communications ABAXIS OS10.9.0 to before 10.12.246; 11.0.0 to before 11.11.80; 12.0.0 to before 12.0.4010.12.246, 11.11.80, 12.0.40Patch availableCNA
Axis Communications ABAXIS OS11.11.0 to before 11.11.80; 12.0.0 to before 12.0.4711.11.80, 12.0.47Patch availableCNA
Axis Communications ABAXIS OS10.10.0 to before 10.12.247; 11.0.0 to before 11.11.85; 12.0.0 to before 12.0.4710.12.247, 11.11.85, 12.0.47Patch availableCNA
Axis Communications ABAXIS OS11.8.0 to before 11.11.85; 12.0.0 to before 12.0.4711.11.85, 12.0.47Patch availableCNA
  • AXIS OS VendorAxis Communications AB Affected 10.9.0 to before 10.12.246; 11.0.0 to before 11.11.80; 12.0.0 to before 12.0.40 Fixed in 10.12.246, 11.11.80, 12.0.40 Patch available CNA
  • AXIS OS VendorAxis Communications AB Affected 11.11.0 to before 11.11.80; 12.0.0 to before 12.0.47 Fixed in 11.11.80, 12.0.47 Patch available CNA
  • AXIS OS VendorAxis Communications AB Affected 10.10.0 to before 10.12.247; 11.0.0 to before 11.11.85; 12.0.0 to before 12.0.47 Fixed in 10.12.247, 11.11.85, 12.0.47 Patch available CNA
  • AXIS OS VendorAxis Communications AB Affected 11.8.0 to before 11.11.85; 12.0.0 to before 12.0.47 Fixed in 11.11.85, 12.0.47 Patch available CNA

CPE names CISA-ADP · 2

CPEVersionsRoleVendor
cpe:2.3:o:axis:axis_os:*:*:*:*:*:*:*:*——Axis Communications AB
cpe:2.3:o:axis:axis_os:11.11:*:*:*:*:*:*:*11.11—Axis Communications AB

Remediation

  • Fix · CNA AXIS OS (Axis Communications AB) Fixed in 10.12.246, 11.11.80, 12.0.40
  • Fix · CNA AXIS OS (Axis Communications AB) Fixed in 11.11.80, 12.0.47
  • Fix · CNA AXIS OS (Axis Communications AB) Fixed in 10.12.247, 11.11.85, 12.0.47
  • Fix · CNA AXIS OS (Axis Communications AB) Fixed in 11.11.85, 12.0.47

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-7784
  2. 2026-10-03 Alias added: GHSA-fmjv-qpc7-997r

References

Other 1

  • TI-2018-07542 An issue was discovered in multiple models of Axis IP Cameras. CVSS 3.0CRITICAL 9.8
  • TI-2018-07541 An issue was discovered in multiple models of Axis IP Cameras. CVSS 3.0CRITICAL 9.8
  • TI-2018-07543 An issue was discovered in multiple models of Axis IP Cameras. CVSS 3.0CRITICAL 9.8
  • TI-2003-00222 The web-based administration capability for various Axis Network Camera products allows… CVSS 2.0HIGH 10.0
  • TI-2015-06802 Multiple cross-site scripting (XSS) vulnerabilities in Axis network cameras. CVSS 3.0MEDIUM 6.1
  • TI-2000-00191 Axis StorPoint CD allows remote attackers to access administrator URLs without… CVSS 2.0HIGH 10.0
See all 123 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences