CVE-2023-21408: Insufficient file permissions leak user credentials of 3rd party integration interfaces in AXIS License Verifier ACAP

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2023-08-03 · updated 2026-06-17
Weakness: CWE-755

Description

Due to insufficient file permissions, unprivileged users could gain access to unencrypted user credentials that are used in the integration interface towards 3rd party systems.

Affected products

Axis Communications AB AXIS License Plate Verifier: through 2.8.3

References

https://www.axis.com/dam/public/0b/1c/96/cve-2023-2140712-en-US-409778.pdf
https://www.axis.com/dam/public/0b/1c/96/cve-2023-2140712-en-US-409778.pdf

Get alerted when CVE-2023-21408 or the next vulnerability affects your stack