CVE-2017-20049

A vulnerability, was found in legacy Axis devices such as P3225 and M3005. This affects an unknown part of the component CGI Script. The manipulation leads to improper privilege management. It is possible to initiate the attack remotely.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
9.8 CRITICAL
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: Unknown
Affected Products (NVD)
VendorProductVersion
axisp1204_firmware
𝑥
≤ 5.50.4
axisp3225_firmware
𝑥
≤ 6.30.1
axisp3367_firmware
𝑥
≤ 6.10.1.2
axism3045_firmware
𝑥
≤ 6.15.4.1
axism3005_firmware
𝑥
≤ 5.50.5.7
axism3007_firmware
𝑥
≤ 6.30.1.1
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://www.axis.com/dam/public/df/f3/dd/cve-2017-20049-en-US-376956.pdf
https://www.axis.com/dam/public/df/f3/dd/cve-2017-20049-en-US-376956.pdf