CVE-2024-47261

Published: Apr 8, 2025Modified: Jun 17, 2026

4.3

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

Exploitability: 2.8 / Impact: 1.4

Source: NVD

Description

51l3nc3, a member of the AXIS OS Bug Bounty Program, has found that the VAPIX API uploadoverlayimage.cgi did not have sufficient input validation to allow an attacker to upload files to block access to create image overlays in the web interface of the Axis device.

Affected (3)

Products: Axis: Axis Os, Axis Os 2022, Axis Os 2024

3 products

Configuration A

3 vulnerable

Vulnerable Software	Affected Versions
Axis Axis Os	From 10.12.0 to 12.3.56
Axis Axis Os 2022	Before 10.12.276
Axis Axis Os 2024	Before 11.11.141

Related CWEs

Improper Validation of Specified Type of Input

The product receives input that is expected to be of a certain type, but it does not validate or incorrectly validates that the input is actually of the expected type.

References (1)

https://www.axis.com/dam/public/18/c5/b2/cve-2024-47261pdf-en-US-474505.pdf

Source: product-security@axis.com

Vendor Advisory

Timeline

No history available yet.