CVE-2023-21405CWE-1286

Denial-of-Service vulnerability in Axis Network Door Controller's and Axis Network Intercom's OSDP communication

Medium · published July 25, 2023

CVSS v3.1
6.5
EPSS
0%
Percentile
21.1
In the wild
Unconfirmed
What it is

Knud from Fraktal.fi has found a flaw in some Axis Network Door Controllers and Axis Network

Intercoms when communicating over OSDP, highlighting that the OSDP message parser crashes

the pacsiod process, causing a temporary unavailability of the door-controlling functionalities

meaning that doors cannot be opened or closed. No sensitive or customer data can be extracted

as the Axis device is not further compromised. Please refer to the Axis security advisory for more information, mitigation and affected products and software versions.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00296 · 21.1th percentile
Weakness
CWE-1286 · Improper Validation of Syntactic Correctness of Input
Published
2023-07-25T07:34Z
EPSS history
Timeline
  • 25 JUL 07:34Z
    Denial-of-Service vulnerability in Axis Network Door Controller's and Axis Network Intercom's OSDP communication
    cvelistv5