The vulnerability arises from insufficient input validation in an ACAP configuration file. An attacker can inject arbitrary commands, potentially enabling privilege escalation on the device. This flaw is identified as CWE-1287, a problem with untrusted input handling.

Axis Communications AB Axis OS devices are impacted. No specific version information is provided; the issue applies wherever unsigned ACAP application installations are allowed.

The CVSS score of 6.0 indicates a medium severity. EPSS data is unavailable and the vulnerability is not listed in the CISA KEV catalog, suggesting no confirmed public exploits yet. Exploitation requires the device to permit unsigned ACAP installations and an attacker convincing a user to install a malicious ACAP. The likely attack vector therefore involves social engineering combined with configuration exploitation, making it less likely to be widely automated but still a concern for exposed or misconfigured devices.