CVE-2023-21405 Denial-of-Service vulnerability in Axis Network Door Controller's and Axis Network Intercom's OSDP communication
Attackers can crash the OSDP parser, causing temporary unavailability of door control functions on Axis network devices.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-21405?
CVE-2023-21405 is a medium-severity denial of service vulnerability in AXIS A1001 Network Door Controller, published on 25 Jul 2023. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Knud from Fraktal.fi has found a flaw in some Axis Network Door Controllers and Axis Network Intercoms when communicating over OSDP, highlighting that the OSDP message parser crashes the pacsiod process, causing a temporary unavailability of the door-controlling functionalities meaning that doors cannot be opened or closed. No sensitive or customer data can be extracted as the Axis device is not further compromised. Please refer to the Axis security advisory for more information, mitigation and affected products and software versions.
Which versions are affected by CVE-2023-21405?
It affects 5 products.
Products include Axis A1001 Firmware, Axis A1210 \(-B\) Firmware, Axis A1601 Firmware, Axis A1610 \(-B\) Firmware, Axis Axis Os.
How do I fix CVE-2023-21405?
No fix has been published for CVE-2023-21405 yet. Limit exposure of the affected software until one is available.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2023-21405 being exploited?
There is no known exploitation of CVE-2023-21405 in the wild and no public exploit code.
Other vulnerabilities in AXIS A1001 Network Door Controller
Sources
Also known as GHSA-m5vf-rp25-854p.