What is CVE-2023-21413?

CVE-2023-21413 is a critical-severity vulnerability in Axis Axis_os, classified under OS Command Injection. CVSS score: 9.1/10. Published 2023-10-16.

How severe is CVE-2023-21413?

Critical severity. CVSS v3 base score is 9.1 out of 10.

RCE in Axis Axis_os

CVE-2023-21413

GoSecure on behalf of Genetec Inc. has found a flaw that allows for a remote code execution during the installation of ACAP applications on the Axis device. The application handling service in AXIS OS was vulnerable to command injection al…

Vulnerability class: Command Injection (OS Command Injection)

EPSS: 0.012 (65.8th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 9.1 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H.

Affected products

Axis Axis_os
Axis Communications Ab Os — versions AXIS OS 10.5 – 11.5

Weakness classification (CWE)

CWE-78 — OS Command Injection
CWE-77 — Command Injection

References

product-security@axis.com (Vendor Advisory)

Frequently asked questions

What is CVE-2023-21413?: CVE-2023-21413 is a critical-severity vulnerability in Axis Axis_os, classified under OS Command Injection. CVSS score: 9.1/10. Published 2023-10-16.
How severe is CVE-2023-21413?: Critical severity. CVSS v3 base score is 9.1 out of 10.