CVE-2024-47259
Published: 04 March 2025
Description
Adversaries may transfer tools or other files from an external system into a compromised environment.
Security Summary
CVE-2024-47259 is a vulnerability in the VAPIX API's dynamicoverlay.cgi component of AXIS OS, stemming from insufficient input validation that enables command injection. This flaw allows attackers to transfer files to affected Axis devices, potentially exhausting system resources. The issue was identified by Girishunawane through the AXIS OS Bug Bounty Program and carries a CVSS v3.1 base score of 3.5 (AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:L/A:N), mapped to CWE-434 (Unrestricted Upload of File with Dangerous Type).
Exploitation requires network access, high attack complexity, and low privileges (PR:L), with no user interaction needed but a changed scope (S:C). A successful attack enables limited integrity impact (I:L), such as uploading files via command injection to deplete resources on the device, though it does not affect confidentiality or availability per the CVSS vector.
Axis has released patched versions of AXIS OS to address this flaw. For detailed mitigation steps and affected products, refer to the official Axis security advisory at https://www.axis.com/dam/public/13/cd/4a/cve-2024-47259pdf-en-US-466882.pdf.
Details
- CWE(s)
Affected Products
MITRE ATT&CK Enterprise Techniques
Why these techniques?
Command injection in public-facing VAPIX API enables T1190 exploitation, Unix shell command execution (T1059.004), and file ingress/transfer (T1105) for resource impact.