← Vulnerability feed

Vulnerability record · CVE-2024-6979 · published 10 September 2024

CVE-2024-6979: Axis os 2024 incorrect authorization vulnerability

Axis · Axis Os 2024

Amin Aliakbari, member of the AXIS OS Bug Bounty Program, has found a broken access control which would lead to less-privileged operator- and/or viewer accounts having more privileges than designed. The risk of exploitation is very low as it requires complex steps to execute, including knowing of account passwords and social engineering attacks in tricking the administrator to perform specific configurations on operator- and/or viewer-privileged accounts. Axis has released patched AXIS OS a version for the highlighted flaw. Please refer to the Axis security advisory for more information and solution.

7.5 CVSS 3.1 High EPSS 0.30% · top 79.2% CWE-863 · Incorrect authorization
7.5CVSS 3.1 base score
0.30%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
1References
17 Jun 2026Last modified by NVD

Description

Amin Aliakbari, member of the AXIS OS Bug Bounty Program, has found a broken access control which would lead to less-privileged operator- and/or viewer accounts having more privileges than designed. The risk of exploitation is very low as it requires complex steps to execute, including knowing of account passwords and social engineering attacks in tricking the administrator to perform specific configurations on operator- and/or viewer-privileged accounts. Axis has released patched AXIS OS a version for the highlighted flaw. Please refer to the Axis security advisory for more information and solution.

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://www.axis.com/dam/public/c3/44/5b/cve-2024-6979-en-US-448997.pdf Vendor Advisory

Track CVE-2024-6979 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

8.8CVE-2025-0324Axis os vulnerabilityThe VAPIX Device Configuration framework allowed a privilege escalation, enabling a lower-privileged user to gain administrator privileges.EPSS 0.40%7.8CVE-2025-0360Axis os incorrect authorization vulnerabilityDuring an annual penetration test conducted on behalf of Axis Communication, Truesec discovered a flaw in the VAPIX Device Configuration framework th…EPSS 0.15%7.1CVE-2024-47259Axis os unrestricted file upload vulnerabilityGirishunawane, member of the AXIS OS Bug Bounty Program, has found that the VAPIX API dynamicoverlay.cgi did not have a sufficient input validation a…EPSS 0.53%5.5CVE-2025-0359Axis os incorrect authorization vulnerabilityDuring an annual penetration test conducted on behalf of Axis Communication, Truesec discovered a flaw in the ACAP Application framework that allowed…EPSS 0.14%5.3CVE-2025-0361Axis os observable discrepancy vulnerabilityDuring an annual penetration test conducted on behalf of Axis Communications, Truesec discovered a flaw in the VAPIX Device Configuration framework t…EPSS 0.33%4.3CVE-2024-47261Axis os vulnerability51l3nc3, a member of the AXIS OS Bug Bounty Program, has found that the VAPIX API uploadoverlayimage.cgi did not have sufficient input validation to …EPSS 0.37%2.7CVE-2024-8160Axis os vulnerabilityErik de Jong, member of the AXIS OS Bug Bounty Program, has found that the VAPIX API ftptest.cgi did not have a sufficient input validation allowing …EPSS 0.64%9.1CVE-2026-71362Adobe commerce incorrect authorization vulnerabilityAdobe Commerce is affected by an Incorrect Authorization vulnerability that could result in privilege escalation. An attacker could leverage this vul…KEVEPSS 88%

Source: NIST National Vulnerability Database (record CVE-2024-6979), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.