CVE-2023-21413criticalCWE-78

CVE-2023-21413: critical vulnerability in AXIS OS

Remote code execution vulnerability during the installation of ACAP applications on the Axis device

Published · Updated

Follow this CVE+ Monitor AXIS OS

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

28Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 9.1epss 1.5%
GoSecure on behalf of Genetec Inc. has found a flaw that allows for a remote code execution during the installation of ACAP applications on the Axis device. The application handling service in AXIS OS was vulnerable to command injection allowing an attacker to run arbitrary code. Axis has released patched AXIS OS versions for the highlighted flaw. Please refer to the Axis security advisory for more information and solution.
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Affected products
Axis Communications AB · AXIS OS
Related CVEs — AXIS OS

In the same product, most dangerous first.

CVE-2025-6779MEDIUMCVE-2025-6779EPSS 1.0%CVE-2021-31988—CVE-2021-31988EPSS 1.0%CVE-2021-31987—CVE-2021-31987EPSS 0.9%CVE-2021-31986—CVE-2021-31986EPSS 0.8%CVE-2023-21415MEDIUMCVE-2023-21415EPSS 0.7%CVE-2023-5800MEDIUMInsufficient input validation in VAPIX API create_overlay.cgiEPSS 0.7%