CVE-2026-5304
Summary
| CVE | CVE-2026-5304 |
|---|---|
| State | PUBLISHED |
| Assigner | Axis |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2026-08-11 06:17:16 UTC |
| Updated | 2026-08-11 06:17:16 UTC |
| Description | An ACAP configuration file lacks input validation, which could potentially lead to privilege escalation. This vulnerability can only be exploited if the Axis device is configured to allow the installation of unsigned ACAP applications, and if an attacker convinces the victim to install a malicious ACAP application. |
Risk And Classification
Primary CVSS: v3.1 5.7 MEDIUM from [email protected]
CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:N
Problem Types: CWE-1287 | CWE-1287 CWE-1287: Improper Validation of Specified Type of Input
| Version | Source | Type | Score | Severity | Vector |
|---|---|---|---|---|---|
| 3.1 | [email protected] | Secondary | 5.7 | MEDIUM | CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:N |
| 3.1 | CNA | CVSS | 5.7 | MEDIUM | CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:N |
CVSS v3.1 Breakdown
Attack Vector
NetworkAttack Complexity
HighPrivileges Required
HighUser Interaction
RequiredScope
UnchangedConfidentiality
HighIntegrity
HighAvailability
NoneCVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:N
Vendor Declared Affected Products
| Source | Vendor | Product | Version | Platforms |
|---|---|---|---|---|
| CNA | Axis Communications AB | AXIS OS | affected 12.0.0 12.11.12 semver | Not specified |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| www.axis.com/dam/public/21/37/f2/cve-2026-5304pdf-en-US-543644.pdf | [email protected] | www.axis.com | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
Vendor Comments And Credit
Discovery Credit
CNA: Cookiejack15 (en)
There are currently no legacy QID mappings associated with this CVE.