CVE-2024-8160 Command injection in AXIS OS
Authenticated administrators can execute arbitrary commands via the VAPIX API to transfer files on Axis devices.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-8160?
CVE-2024-8160 is a low-severity command injection vulnerability in AXIS OS, published on 26 Nov 2024. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
Erik de Jong, member of the AXIS OS Bug Bounty Program, has found that the VAPIX API ftptest.cgi did not have a sufficient input validation allowing for a possible command injection leading to being able to transfer files from/to the Axis device. This flaw can only be exploited after authenticating with an administrator-privileged service account. Axis has released patched AXIS OS versions for the highlighted flaw. Please refer to the Axis security advisory for more information and solution.
Weakness: CWE-1286
Which versions are affected by CVE-2024-8160?
It affects 3 products.
Products include Axis Axis Os, Axis Axis Os 2022, Axis Axis Os 2024.
How do I fix CVE-2024-8160?
No fix has been published for CVE-2024-8160 yet. Limit exposure of the affected software until one is available.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2024-8160 being exploited?
There is no known exploitation of CVE-2024-8160 in the wild and no public exploit code.
Other vulnerabilities in AXIS OS
Sources
Also known as GHSA-qj8p-c5h3-g242.