CVE-2021-31988: Axis OS

High severity, CVSS 8.8. EPSS: 1% chance of exploitation in the next 30 days.

A user controlled parameter related to SMTP test functionality is not correctly validated making it possible to add the Carriage Return and Line Feed (CRLF) control characters and include arbitrary SMTP headers in the generated test email.

Affected products

• Axis Axis OS: before 10.7 (fixed in 10.7)
• Axis Axis OS 2016: before 6.50.5.5 (fixed in 6.50.5.5)
• Axis Axis OS 2018: before 8.40.4.3 (fixed in 8.40.4.3)
• Axis Axis OS 2020: before 9.80.3.5 (fixed in 9.80.3.5)

Published 2021-10-05. Last modified 2026-06-17.