CVE-2023-5677 Command injection in AXIS OS
Authenticated attackers can execute arbitrary code via insufficient input validation in the VAPIX API tcptest.cgi endpoint on Axis devices.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-5677?
CVE-2023-5677 is a medium-severity command injection vulnerability in AXIS OS, published on 5 Feb 2024. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Brandon Rothel from QED Secure Solutions and Sam Hanson of Dragos have found that the VAPIX API tcptest.cgi did not have a sufficient input validation allowing for a possible remote code execution. This flaw can only be exploited after authenticating with an operator- or administrator-privileged service account. The impact of exploiting this vulnerability is lower with operator-privileges compared to administrator-privileges service accounts. Please refer to the Axis security advisory for more information and solution.
Which versions are affected by CVE-2023-5677?
It affects 11 products.
Products include Axis M3024-Lve Firmware, Axis M3025-Ve Firmware, Axis M7014 Firmware, Axis M7016 Firmware, Axis P1214-E Firmware, Axis P7214 Firmware and 5 more.
How do I fix CVE-2023-5677?
No fix has been published for CVE-2023-5677 yet. Limit exposure of the affected software until one is available.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2023-5677 being exploited?
There is no known exploitation of CVE-2023-5677 in the wild and no public exploit code.
Sources
Also known as GHSA-wpw2-f6x3-8f7j.