CVE-2024-47259CWE-434

Girishunawane, member of the AXIS OS Bug Bounty Program, has found that the VAPIX API dynamicoverlay.cgi did not have a sufficient input validation allowing…

Low · published March 4, 2025

CVSS v3.1
3.5
EPSS
1%
Percentile
44.2
In the wild
Unconfirmed
What it is

Girishunawane, member of the AXIS OS Bug Bounty Program, has found that the VAPIX API dynamicoverlay.cgi did not have a sufficient input validation allowing for a possible command injection leading to being able to transfer files to the Axis device with the purpose to exhaust system resources.

Axis has released patched AXIS OS versions for the highlighted flaw. Please refer to the Axis security advisory for more information and solution.

The record
Technical detail
CVSS v3.1
3.5 · LOW
Vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00532 · 44.2th percentile
Weakness
CWE-434 · Unrestricted Upload of File with Dangerous Type
Published
2025-03-04T05:15Z
EPSS history
Timeline
  • 04 MAR 05:15Z
    Girishunawane, member of the AXIS OS Bug Bounty Program, has found that the VAPIX API dynamicoverlay.cgi did not have a sufficient input validation allowing…
    cvelistv5