← Vulnerability feed

Vulnerability record · CVE-2023-5800 · published 5 February 2024

CVE-2023-5800: Axis os code injection vulnerability

Axis · Axis Os

Vintage, member of the AXIS OS Bug Bounty Program, has found that the VAPIX API create_overlay.cgi did not have a sufficient input validation allowing for a possible remote code execution. This flaw can only be exploited after authenticating with an operator- or administrator-privileged service account. Axis has released patched AXIS OS versions for the highlighted flaw. Please refer to the Axis security advisory for more information and solution.

8.8 CVSS 3.1 High EPSS 0.68% · top 49.4% CWE-35 · CWE-35CWE-94 · Code injection
8.8CVSS 3.1 base score
0.68%EPSS exploitation probability, 30 days
NoNot in CISA KEV
3Affected product versions listed by NVD
2References
17 Jun 2026Last modified by NVD

Description

Vintage, member of the AXIS OS Bug Bounty Program, has found that the VAPIX API create_overlay.cgi did not have a sufficient input validation allowing for a possible remote code execution. This flaw can only be exploited after authenticating with an operator- or administrator-privileged service account. Axis has released patched AXIS OS versions for the highlighted flaw. Please refer to the Axis security advisory for more information and solution.

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected products

3 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://www.axis.com/dam/public/89/d9/99/cve-2023-5800-en-US-424339.pdf Vendor Advisory
https://www.axis.com/dam/public/89/d9/99/cve-2023-5800-en-US-424339.pdf Vendor Advisory

Track CVE-2023-5800 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

8.8CVE-2026-1185Axis os incorrect permission assignment vulnerabilityA configuration file on the local file system had improper input validation which could allow code execution and potentially lead to privilege escala…EPSS 0.23%8.8CVE-2025-11142Axis os os command injection vulnerabilityThe VAPIX API mediaclip.cgi that did not have a sufficient input validation allowing for a possible remote code execution. This flaw can only be expl…EPSS 0.52%8.8CVE-2025-0324Axis os vulnerabilityThe VAPIX Device Configuration framework allowed a privilege escalation, enabling a lower-privileged user to gain administrator privileges.EPSS 0.40%8.8CVE-2025-0358Axis os improper privilege management vulnerabilityDuring an annual penetration test conducted on behalf of Axis Communication, Truesec discovered a flaw in the VAPIX Device Configuration framework th…EPSS 0.25%8.8CVE-2021-31988Axis os injection vulnerabilityA user controlled parameter related to SMTP test functionality is not correctly validated making it possible to add the Carriage Return and Line Feed…EPSS 0.95%8.1CVE-2023-21415Axis os path traversal vulnerabilitySandro Poppi, member of the AXIS OS Bug Bounty Program, has found that the VAPIX API overlay_del.cgi is vulnerable to path traversal attacks that all…EPSS 0.59%7.8CVE-2025-0360Axis os incorrect authorization vulnerabilityDuring an annual penetration test conducted on behalf of Axis Communication, Truesec discovered a flaw in the VAPIX Device Configuration framework th…EPSS 0.14%7.5CVE-2021-31987Axis os vulnerabilityA user controlled parameter related to SMTP test functionality is not correctly validated making it possible to bypass blocked network recipients.EPSS 0.89%

Source: NIST National Vulnerability Database (record CVE-2023-5800), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.