A configuration file on the local file system had improper input validation that could allow execution of arbitrary code. The flaw permits an attacker to inject code that runs with the privileges of the device, potentially leading to a full compromise of the system. The weakness is classified as CWE-732, relating to improper permission assignments or access controls.

Axis Communications AB’s AXIS OS is affected. No specific version numbers are listed in the publicly available data, so any installation of AXIS OS that uses the relevant configuration file could be vulnerable.

The CVSS score of 5.4 indicates a medium severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting that it has not yet been observed in widespread exploitation. Exploitation requires an attacker to first log in to the device via SSH, implying that only users with privileged SSH access can exploit the flaw. Given these conditions, the risk is moderate but not negligible.