TI-2024-31597 Aliases CVE-2024-47262 GHSA-mh24-4g35-88jp

Dzmitry Lukyanenka, member of the AXIS OS Bug Bounty Program, has found that the VAPIX…

LOW 30CWE-1287Published 2025-03-04 · Updated 2025-03-28

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: —
Confidentiality · integrity · availability: None · None · Low
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

Dzmitry Lukyanenka, member of the AXIS OS Bug Bounty Program, has found that the VAPIX API param.cgi was vulnerable to a race condition attack allowing for an attacker to block access to the web interface of the Axis device. Other API endpoints or services not making use of param.cgi are not affected. Axis has released patched AXIS OS versions for the highlighted flaw. Please refer to the Axis security advisory for more information and solution.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00365 30th percentileScored 2026-11-07

Fix Fixed AXIS OS (Axis Communications AB): 6.50.5.19, 8.40.66, 9.80.90 +3

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: Yes
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Axis Communications AB	AXIS OS	6.50.0 to before 6.50.5.19; 7.0.0 to before 8.40.66; 9.0.0 to before 9.80.90; 10.0.0 to before 10.12.270; 11.0.0 to before 11.11.127; 12.0.0 to before 12.3.4	6.50.5.19, 8.40.66, 9.80.90, 10.12.270, 11.11.127, 12.3.4	Patch available	CNA

AXIS OS VendorAxis Communications AB Affected 6.50.0 to before 6.50.5.19; 7.0.0 to before 8.40.66; 9.0.0 to before 9.80.90; 10.0.0 to before 10.12.270; 11.0.0 to before 11.11.127; 12.0.0 to before 12.3.4 Fixed in 6.50.5.19, 8.40.66, 9.80.90, 10.12.270, 11.11.127, 12.3.4 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPE	Versions	Role	Vendor
cpe:2.3:o:axis:axis_os::::::::	—	—	Axis Communications AB

cpe:2.3:o:axis:axis_os:*:*:*:*:*:*:*:* Versions — — ·Axis Communications AB

Remediation

Fix · CNA AXIS OS (Axis Communications AB) Fixed in 6.50.5.19, 8.40.66, 9.80.90, 10.12.270, 11.11.127, 12.3.4

Timeline

2026-10-02 Threatist record created from CVE-2024-47262
2026-10-03 Alias added: GHSA-mh24-4g35-88jp

References

Other 1

https://www.axis.com/dam/public/a3/18/6e/cve-2024-47262pdf-en-US-466884.pdf

TI-2018-07542 An issue was discovered in multiple models of Axis IP Cameras. CVSS 3.0CRITICAL 9.8
TI-2018-07541 An issue was discovered in multiple models of Axis IP Cameras. CVSS 3.0CRITICAL 9.8
TI-2018-07543 An issue was discovered in multiple models of Axis IP Cameras. CVSS 3.0CRITICAL 9.8
TI-2003-00222 The web-based administration capability for various Axis Network Camera products allows… CVSS 2.0HIGH 10.0
TI-2015-06802 Multiple cross-site scripting (XSS) vulnerabilities in Axis network cameras. CVSS 3.0MEDIUM 6.1
TI-2000-00191 Axis StorPoint CD allows remote attackers to access administrator URLs without… CVSS 2.0HIGH 10.0

See all 123 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences