TI-2024-08138 Aliases CVE-2024-8772 GHSA-3v44-23hf-q5wp

51l3nc3, member of the AXIS OS Bug Bounty Program, has found that the VAPIX API…

LOW 20CWE-1286Published 2024-11-26 · Updated 2025-03-28

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Impact type: —
Confidentiality · integrity · availability: None · None · Low
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

51l3nc3, member of the AXIS OS Bug Bounty Program, has found that the VAPIX API managedoverlayimages.cgi was vulnerable to a race condition attack allowing for an attacker to block access to the overlay configuration page in the web interface of the Axis device. This flaw can only be exploited after authenticating with an operator- or administrator-privileged service account. Axis has released patched AXIS OS versions for the highlighted flaw. Please refer to the Axis security advisory for more information and solution.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.0044 38th percentileScored 2026-11-07

Fix Fixed AXIS OS (Axis Communications AB): 9.80.84, 10.12.259, 11.11.118 +1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Axis Communications AB	AXIS OS	9.80.0 to before 9.80.84; 10.0.0 to before 10.12.259; 11.0.0 to before 11.11.118; 12.0.0 to before 12.1.28	9.80.84, 10.12.259, 11.11.118, 12.1.28	Patch available	CNA

AXIS OS VendorAxis Communications AB Affected 9.80.0 to before 9.80.84; 10.0.0 to before 10.12.259; 11.0.0 to before 11.11.118; 12.0.0 to before 12.1.28 Fixed in 9.80.84, 10.12.259, 11.11.118, 12.1.28 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPE	Versions	Role	Vendor
cpe:2.3:o:axis:axis_os::::::::	—	—	Axis Communications AB

cpe:2.3:o:axis:axis_os:*:*:*:*:*:*:*:* Versions — — ·Axis Communications AB

Remediation

Fix · CNA AXIS OS (Axis Communications AB) Fixed in 9.80.84, 10.12.259, 11.11.118, 12.1.28

Timeline

2026-10-02 Threatist record created from CVE-2024-8772
2026-10-03 Alias added: GHSA-3v44-23hf-q5wp

References

Other 1

https://www.axis.com/dam/public/permalink/231072/cve-2024-8772pdf-en-US_InternalID-231072.pdf

TI-2018-07542 An issue was discovered in multiple models of Axis IP Cameras. CVSS 3.0CRITICAL 9.8
TI-2018-07541 An issue was discovered in multiple models of Axis IP Cameras. CVSS 3.0CRITICAL 9.8
TI-2018-07543 An issue was discovered in multiple models of Axis IP Cameras. CVSS 3.0CRITICAL 9.8
TI-2003-00222 The web-based administration capability for various Axis Network Camera products allows… CVSS 2.0HIGH 10.0
TI-2015-06802 Multiple cross-site scripting (XSS) vulnerabilities in Axis network cameras. CVSS 3.0MEDIUM 6.1
TI-2000-00191 Axis StorPoint CD allows remote attackers to access administrator URLs without… CVSS 2.0HIGH 10.0

See all 123 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences