Axis OS 2018 vulnerabilities

5 CVEs affecting Axis OS 2018, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2023-21418, published 2023-11-21.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2021-31988, published 2021-10-05. High severity, CVSS 8.8. EPSS: 1% chance of exploitation in the next 30 days. A user controlled parameter related to SMTP test functionality is not correctly validated making it possible to add the Carriage Return and Line Feed (CRLF) control characters and include arbitrary…
CVE-2021-31987, published 2021-10-05. High severity, CVSS 7.5. EPSS: 0.9% chance of exploitation in the next 30 days. A user controlled parameter related to SMTP test functionality is not correctly validated making it possible to bypass blocked network recipients.
CVE-2021-31986, published 2021-10-05. Medium severity, CVSS 6.8. EPSS: 0.8% chance of exploitation in the next 30 days. User controlled parameters related to SMTP notifications are not correctly validated. This can lead to a buffer overflow resulting in crashes and data leakage.
CVE-2023-21415, published 2023-10-16. High severity, CVSS 8.1. EPSS: 0.7% chance of exploitation in the next 30 days. Sandro Poppi, member of the AXIS OS Bug Bounty Program, has found that the VAPIX API overlay_del.cgi is vulnerable to path traversal attacks that allows for file deletion. This flaw can only be…
CVE-2023-21418, published 2023-11-21. High severity, CVSS 7.1. EPSS: 0.7% chance of exploitation in the next 30 days. Sandro Poppi, member of the AXIS OS Bug Bounty Program, has found that the VAPIX API irissetup.cgi was vulnerable to path traversal attacks that allows for file deletion. This flaw can only be…