CVE-2023-5677

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2023-5677
Brandon Rothel from QED Secure Solutions and Sam Hanson of Dragos have found that the VAPIX API tcptest.cgi did not have a sufficient input validation allowing for a possible remote code execution. This flaw can only be exploited after authenticating with an operator- or administrator-privileged service account. The impact of exploiting this vulnerability is lower with operator-privileges compared to administrator-privileges service accounts. Please refer to the Axis security advisory for more information and solution.

8.8 /10

CVSS v3.0 : HIGH

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://www.axis.com/dam/public/0a/47/d1/cve-2023-5677-en-US-483444.pdf
https://www.axis.com/dam/public/a9/dd/f1/cve-2023-5677-en-US-424335.pdf Vendor Advisory
Configurations

Configuration 1 (hide)

AND
cpe:2.3:o:axis:m3024-lve_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:axis:m3024-lve:-:*:*:*:*:*:*:*

Configuration 2 (hide)

AND
cpe:2.3:o:axis:m3025-ve_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:axis:m3025-ve:-:*:*:*:*:*:*:*

Configuration 3 (hide)

AND
cpe:2.3:o:axis:m7014_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:axis:m7014:-:*:*:*:*:*:*:*

Configuration 4 (hide)

AND
cpe:2.3:o:axis:m7016_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:axis:m7016:-:*:*:*:*:*:*:*

Configuration 5 (hide)

AND
cpe:2.3:o:axis:p1214-e_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:axis:p1214-e:-:*:*:*:*:*:*:*

Configuration 6 (hide)

AND
cpe:2.3:o:axis:p7214_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:axis:p7214:-:*:*:*:*:*:*:*

Configuration 7 (hide)

AND
cpe:2.3:o:axis:p7216_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:axis:p7216:-:*:*:*:*:*:*:*

Configuration 8 (hide)

AND
cpe:2.3:o:axis:q7401_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:axis:q7401:-:*:*:*:*:*:*:*

Configuration 9 (hide)

AND
cpe:2.3:o:axis:q7404_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:axis:q7404:-:*:*:*:*:*:*:*

Configuration 10 (hide)

AND
cpe:2.3:o:axis:q7414_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:axis:q7414:-:*:*:*:*:*:*:*

Configuration 11 (hide)

AND
cpe:2.3:o:axis:q7424-r_mk_ii_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:axis:q7424-r_mk_ii:-:*:*:*:*:*:*:*
History

15 May 2025, 10:15

Type Values Removed Values Added
Summary Brandon Rothel from QED Secure Solutions has found that the VAPIX API tcptest.cgi did not have a sufficient input validation allowing for a possible remote code execution. This flaw can only be exploited after authenticating with an operator- or administrator-privileged service account. The impact of exploiting this vulnerability is lower with operator-privileges compared to administrator-privileges service accounts. Axis has released patched AXIS OS versions for the highlighted flaw. Please refer to the Axis security advisory for more information and solution. Brandon Rothel from QED Secure Solutions and Sam Hanson of Dragos have found that the VAPIX API tcptest.cgi did not have a sufficient input validation allowing for a possible remote code execution. This flaw can only be exploited after authenticating with an operator- or administrator-privileged service account. The impact of exploiting this vulnerability is lower with operator-privileges compared to administrator-privileges service accounts. Please refer to the Axis security advisory for more information and solution.
References
  • () https://www.axis.com/dam/public/0a/47/d1/cve-2023-5677-en-US-483444.pdf -

08 Nov 2024, 09:15

Type Values Removed Values Added
Summary Brandon Rothel from QED Secure Solutions has found that the VAPIX API tcptest.cgi did not have a sufficient input validation allowing for a possible remote code execution. This flaw can only be exploited after authenticating with an operator- or administrator-privileged service account. The impact of exploiting this vulnerability is lower with operator-privileges compared to administrator-privileges service accounts. Axis has released patched AXIS OS versions for the highlighted flaw. Please refer to the Axis security advisory for more information and solution. Brandon Rothel from QED Secure Solutions has found that the VAPIX API tcptest.cgi did not have a sufficient input validation allowing for a possible remote code execution. This flaw can only be exploited after authenticating with an operator- or administrator-privileged service account. The impact of exploiting this vulnerability is lower with operator-privileges compared to administrator-privileges service accounts. Axis has released patched AXIS OS versions for the highlighted flaw. Please refer to the Axis security advisory for more information and solution.

13 Feb 2024, 00:38

Type Values Removed Values Added
References () https://www.axis.com/dam/public/a9/dd/f1/cve-2023-5677-en-US-424335.pdf - () https://www.axis.com/dam/public/a9/dd/f1/cve-2023-5677-en-US-424335.pdf - Vendor Advisory
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 8.8
CWE CWE-94
CPE cpe:2.3:o:axis:m7016_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:axis:m7014:-:*:*:*:*:*:*:*
cpe:2.3:o:axis:p7214_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:axis:q7401:-:*:*:*:*:*:*:*
cpe:2.3:h:axis:p7214:-:*:*:*:*:*:*:*
cpe:2.3:h:axis:q7424-r_mk_ii:-:*:*:*:*:*:*:*
cpe:2.3:h:axis:m7016:-:*:*:*:*:*:*:*
cpe:2.3:o:axis:m3025-ve_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:axis:q7424-r_mk_ii_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:axis:p7216_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:axis:p1214-e_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:axis:q7404:-:*:*:*:*:*:*:*
cpe:2.3:h:axis:q7414:-:*:*:*:*:*:*:*
cpe:2.3:h:axis:p1214-e:-:*:*:*:*:*:*:*
cpe:2.3:o:axis:q7404_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:axis:q7414_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:axis:m3024-lve:-:*:*:*:*:*:*:*
cpe:2.3:h:axis:m3025-ve:-:*:*:*:*:*:*:*
cpe:2.3:o:axis:m3024-lve_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:axis:q7401_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:axis:m7014_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:axis:p7216:-:*:*:*:*:*:*:*
First Time Axis q7401 Firmware
Axis m3024-lve Firmware
Axis q7401
Axis p1214-e
Axis q7424-r Mk Ii
Axis p7214 Firmware
Axis q7404 Firmware
Axis m3025-ve
Axis m7014
Axis q7414 Firmware
Axis p7216 Firmware
Axis m3025-ve Firmware
Axis q7414
Axis m7016
Axis
Axis m3024-lve
Axis m7014 Firmware
Axis p1214-e Firmware
Axis q7404
Axis q7424-r Mk Ii Firmware
Axis p7216
Axis p7214
Axis m7016 Firmware

05 Feb 2024, 06:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-02-05 06:15

Updated : 2025-05-15 10:15

NVD link : CVE-2023-5677

Mitre link : CVE-2023-5677

JSON object : View

Products Affected

axis

  • p7216
  • q7424-r_mk_ii_firmware
  • m7016
  • m3024-lve_firmware
  • q7401_firmware
  • m7014
  • p7214_firmware
  • q7404_firmware
  • q7424-r_mk_ii
  • q7404
  • p7214
  • m3025-ve
  • m3025-ve_firmware
  • p1214-e_firmware
  • q7414_firmware
  • q7414
  • q7401
  • m3024-lve
  • m7014_firmware
  • p7216_firmware
  • p1214-e
  • m7016_firmware
CWE
CWE-94

Improper Control of Generation of Code ('Code Injection')