CVE-2024-7784 (GCVE-0-2024-7784)
Vulnerability from cvelistv5
Published
2024-09-10 05:14
Modified
2025-03-28 07:23
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-121 - Stack-based Buffer Overflow
Summary
During internal Axis Security Development Model (ASDM) threat-modelling, a flaw was found in the protection for device tampering (commonly known as Secure Boot) in AXIS OS making it vulnerable to a sophisticated attack to bypass this protection. To Axis' knowledge, there are no known exploits of the vulnerability at this time. Axis has released patched AXIS OS versions for the highlighted flaw. Please refer to the Axis security advisory for more information and solution.
References
Impacted products
| Vendor | Product | Version | |||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| ► | Axis Communications AB | AXIS OS |
Version: 10.9.0 ≤ Version: 11.0.0 ≤ Version: 12.0.0 ≤ |
||||||||||||||||
|
|||||||||||||||||||
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:o:axis:axis_os:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "axis_os",
"vendor": "axis",
"versions": [
{
"lessThan": "11.11",
"status": "affected",
"version": "10.9",
"versionType": "custom"
},
{
"lessThan": "11.11",
"status": "affected",
"version": "10.10",
"versionType": "custom"
},
{
"lessThan": "11.11",
"status": "affected",
"version": "11.8",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:axis:axis_os:11.11:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "axis_os",
"vendor": "axis",
"versions": [
{
"status": "affected",
"version": "11.11"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-7784",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-09-10T18:09:41.112495Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-09-10T18:28:46.063Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"ARTPEC 8"
],
"product": "AXIS OS",
"vendor": "Axis Communications AB",
"versions": [
{
"lessThan": "10.12.246",
"status": "affected",
"version": "10.9.0",
"versionType": "semver"
},
{
"lessThan": "11.11.80",
"status": "affected",
"version": "11.0.0",
"versionType": "semver"
},
{
"lessThan": "12.0.40",
"status": "affected",
"version": "12.0.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"platforms": [
"i.MX8 QP"
],
"product": "AXIS OS",
"vendor": "Axis Communications AB",
"versions": [
{
"lessThan": "11.11.80",
"status": "affected",
"version": "11.11.0",
"versionType": "semver"
},
{
"lessThan": "12.0.47",
"status": "affected",
"version": "12.0.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"platforms": [
"i.MX6 SX",
"i.MX6 ULL"
],
"product": "AXIS OS",
"vendor": "Axis Communications AB",
"versions": [
{
"lessThan": "10.12.247",
"status": "affected",
"version": "10.10.0",
"versionType": "semver"
},
{
"lessThan": "11.11.85",
"status": "affected",
"version": "11.0.0",
"versionType": "semver"
},
{
"lessThan": "12.0.47",
"status": "affected",
"version": "12.0.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"platforms": [
"i.MX8M Mini",
"i.MX8M Nano UL"
],
"product": "AXIS OS",
"vendor": "Axis Communications AB",
"versions": [
{
"lessThan": "11.11.85",
"status": "affected",
"version": "11.8.0",
"versionType": "semver"
},
{
"lessThan": "12.0.47",
"status": "affected",
"version": "12.0.0",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "During internal Axis Security Development Model (ASDM) threat-modelling, a flaw was found in the protection for device tampering (commonly known as Secure Boot) in AXIS OS making it vulnerable to a sophisticated attack to bypass this protection. To Axis\u0027 knowledge, there are no known exploits of the vulnerability at this time. Axis has released patched AXIS OS versions for the highlighted flaw. Please refer to the Axis security advisory for more information and solution."
}
],
"value": "During internal Axis Security Development Model (ASDM) threat-modelling, a flaw was found in the protection for device tampering (commonly known as Secure Boot) in AXIS OS making it vulnerable to a sophisticated attack to bypass this protection. To Axis\u0027 knowledge, there are no known exploits of the vulnerability at this time. Axis has released patched AXIS OS versions for the highlighted flaw. Please refer to the Axis security advisory for more information and solution."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "PHYSICAL",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-121",
"description": "CWE-121: Stack-based Buffer Overflow",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-03-28T07:23:28.450Z",
"orgId": "f2daf9a0-02c2-4b83-a01d-63b3b304b807",
"shortName": "Axis"
},
"references": [
{
"url": "https://www.axis.com/dam/public/ba/5f/4e/cve-2024-7784-en-US-448998.pdf"
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "f2daf9a0-02c2-4b83-a01d-63b3b304b807",
"assignerShortName": "Axis",
"cveId": "CVE-2024-7784",
"datePublished": "2024-09-10T05:14:33.855Z",
"dateReserved": "2024-08-14T07:55:10.630Z",
"dateUpdated": "2025-03-28T07:23:28.450Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1",
"vulnerability-lookup:meta": {
"vulnrichment": {
"containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-7784\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-09-10T18:09:41.112495Z\"}}}], \"affected\": [{\"cpes\": [\"cpe:2.3:o:axis:axis_os:*:*:*:*:*:*:*:*\"], \"vendor\": \"axis\", \"product\": \"axis_os\", \"versions\": [{\"status\": \"affected\", \"version\": \"10.9\", \"lessThan\": \"11.11\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"10.10\", \"lessThan\": \"11.11\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"11.8\", \"lessThan\": \"11.11\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unknown\"}, {\"cpes\": [\"cpe:2.3:o:axis:axis_os:11.11:*:*:*:*:*:*:*\"], \"vendor\": \"axis\", \"product\": \"axis_os\", \"versions\": [{\"status\": \"affected\", \"version\": \"11.11\"}], \"defaultStatus\": \"unknown\"}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-09-10T18:28:38.768Z\"}}], \"cna\": {\"source\": {\"discovery\": \"UNKNOWN\"}, \"metrics\": [{\"format\": \"CVSS\", \"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 6.1, \"attackVector\": \"PHYSICAL\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"NONE\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"HIGH\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}], \"affected\": [{\"vendor\": \"Axis Communications AB\", \"product\": \"AXIS OS\", \"versions\": [{\"status\": \"affected\", \"version\": \"10.9.0\", \"lessThan\": \"10.12.246\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"11.0.0\", \"lessThan\": \"11.11.80\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"12.0.0\", \"lessThan\": \"12.0.40\", \"versionType\": \"semver\"}], \"platforms\": [\"ARTPEC 8\"], \"defaultStatus\": \"unaffected\"}, {\"vendor\": \"Axis Communications AB\", \"product\": \"AXIS OS\", \"versions\": [{\"status\": \"affected\", \"version\": \"11.11.0\", \"lessThan\": \"11.11.80\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"12.0.0\", \"lessThan\": \"12.0.47\", \"versionType\": \"semver\"}], \"platforms\": [\"i.MX8 QP\"], \"defaultStatus\": \"unaffected\"}, {\"vendor\": \"Axis Communications AB\", \"product\": \"AXIS OS\", \"versions\": [{\"status\": \"affected\", \"version\": \"10.10.0\", \"lessThan\": \"10.12.247\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"11.0.0\", \"lessThan\": \"11.11.85\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"12.0.0\", \"lessThan\": \"12.0.47\", \"versionType\": \"semver\"}], \"platforms\": [\"i.MX6 SX\", \"i.MX6 ULL\"], \"defaultStatus\": \"unaffected\"}, {\"vendor\": \"Axis Communications AB\", \"product\": \"AXIS OS\", \"versions\": [{\"status\": \"affected\", \"version\": \"11.8.0\", \"lessThan\": \"11.11.85\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"12.0.0\", \"lessThan\": \"12.0.47\", \"versionType\": \"semver\"}], \"platforms\": [\"i.MX8M Mini\", \"i.MX8M Nano UL\"], \"defaultStatus\": \"unaffected\"}], \"references\": [{\"url\": \"https://www.axis.com/dam/public/ba/5f/4e/cve-2024-7784-en-US-448998.pdf\"}], \"x_generator\": {\"engine\": \"Vulnogram 0.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"During internal Axis Security Development Model (ASDM) threat-modelling, a flaw was found in the protection for device tampering (commonly known as Secure Boot) in AXIS OS making it vulnerable to a sophisticated attack to bypass this protection. To Axis\u0027 knowledge, there are no known exploits of the vulnerability at this time. Axis has released patched AXIS OS versions for the highlighted flaw. Please refer to the Axis security advisory for more information and solution.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"During internal Axis Security Development Model (ASDM) threat-modelling, a flaw was found in the protection for device tampering (commonly known as Secure Boot) in AXIS OS making it vulnerable to a sophisticated attack to bypass this protection. To Axis\u0027 knowledge, there are no known exploits of the vulnerability at this time. Axis has released patched AXIS OS versions for the highlighted flaw. Please refer to the Axis security advisory for more information and solution.\", \"base64\": false}]}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-121\", \"description\": \"CWE-121: Stack-based Buffer Overflow\"}]}], \"providerMetadata\": {\"orgId\": \"f2daf9a0-02c2-4b83-a01d-63b3b304b807\", \"shortName\": \"Axis\", \"dateUpdated\": \"2025-03-28T07:23:28.450Z\"}}}",
"cveMetadata": "{\"cveId\": \"CVE-2024-7784\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2025-03-28T07:23:28.450Z\", \"dateReserved\": \"2024-08-14T07:55:10.630Z\", \"assignerOrgId\": \"f2daf9a0-02c2-4b83-a01d-63b3b304b807\", \"datePublished\": \"2024-09-10T05:14:33.855Z\", \"assignerShortName\": \"Axis\"}",
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
}
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.
Loading…
Loading…