9.8crit
CVE-2017-20049
A vulnerability, was found in legacy Axis devices such as P3225 and M3005.
Published 4 y ago · modified 4 mo ago · JSON
CVSS
9.8
v3.1 · NVD
CISA KEV
No
not known exploited
EPSS
1.6%
percentile 76%
Public exploits
0
none known
Summary
A vulnerability, was found in legacy Axis devices such as P3225 and M3005. This affects an unknown part of the component CGI Script. The manipulation leads to improper privilege management. It is possible to initiate the attack remotely.
Exploit prediction (EPSS)
1.58% probability of exploitation in the next 30 days, higher than 76% of all scored CVEs.
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| NVD | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| NVD | 2.0 | 10.0 | AV:N/AC:L/Au:N/C:C/I:C/A:C |
Affected products
- n/a AXIS OS
Classification
- Weakness
- CWE-269 Improper Privilege Management
References
- axis.com /dam/public/df/f3/dd/cve-2017-20049-en-US-376956.pdf · x_refsource_MISC, x_transferred
Sources
- CVE List: CVE-2017-20049
- NVD: CVE-2017-20049
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.