CVE-2023-5677

Severity: high (CVSS 8.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-02-05 · updated 2026-06-17
Weakness: CWE-78

Description

Brandon Rothel from QED Secure Solutions and Sam Hanson of Dragos have found that the VAPIX API tcptest.cgi did not have a sufficient input validation allowing for a possible remote code execution. This flaw can only be exploited after authenticating with an operator- or administrator-privileged service account. The impact of exploiting this vulnerability is lower with operator-privileges compared to administrator-privileges service accounts. Please refer to the Axis security advisory for more information and solution.

Affected products

Axis M3024-Lve Firmware: before 5.51.7.7 — fixed in 5.51.7.7
Axis M3025-Ve Firmware: before 5.51.7.7 — fixed in 5.51.7.7
Axis M7014 Firmware: before 5.51.7.7 — fixed in 5.51.7.7
Axis M7016 Firmware: before 5.51.7.7 — fixed in 5.51.7.7
Axis P1214-E Firmware: before 5.51.7.7 — fixed in 5.51.7.7
Axis P7214 Firmware: before 5.51.7.7 — fixed in 5.51.7.7
Axis P7216 Firmware: before 5.51.7.7 — fixed in 5.51.7.7
Axis Q7401 Firmware: before 5.51.7.7 — fixed in 5.51.7.7
Axis Q7404 Firmware: before 5.51.7.7 — fixed in 5.51.7.7
Axis Q7414 Firmware: before 5.51.7.7 — fixed in 5.51.7.7
Axis Q7424-R Mk Ii Firmware: before 5.51.3.9 — fixed in 5.51.3.9

How to fix

Upgrade to a fixed version: Axis M3024-Lve Firmware 5.51.7.7; Axis M3025-Ve Firmware 5.51.7.7; Axis M7014 Firmware 5.51.7.7; Axis M7016 Firmware 5.51.7.7; Axis P1214-E Firmware 5.51.7.7; Axis P7214 Firmware 5.51.7.7; Axis P7216 Firmware 5.51.7.7; Axis Q7401 Firmware 5.51.7.7; Axis Q7404 Firmware 5.51.7.7; Axis Q7414 Firmware 5.51.7.7; Axis Q7424-R Mk Ii Firmware 5.51.3.9. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2023-5677 or the next vulnerability affects your stack