CVE-2026-0804 in AXIS OS
Summary
by MITRE • 05/12/2026
An ACAP configuration file lacked sufficient input validation, which could allow a path traversal attack leading to potential privilege escalation. This vulnerability can only be exploited if the Axis device is configured to allow the installation of unsigned ACAP applications, and if an attacker convinces the victim to install a malicious ACAP application.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 05/20/2026
This vulnerability represents a critical security flaw in Axis network video surveillance devices that leverages insufficient input validation within ACAP configuration file processing. The issue stems from improper validation of user-supplied input during the installation and execution of ACAP applications, creating a path traversal attack vector that could potentially lead to privilege escalation. The vulnerability specifically affects devices configured to permit installation of unsigned ACAP applications, which represents a significant security risk as it bypasses the normal security controls that would typically prevent unauthorized code execution. According to CWE standards, this vulnerability maps to CWE-22 Path Traversal and CWE-787 Out-of-bounds Write, as the lack of proper input validation allows attackers to manipulate file paths and potentially execute arbitrary code with elevated privileges. The attack requires specific preconditions where the device configuration permits unsigned application installation and where an attacker can successfully convince a victim to install malicious software, making this a sophisticated supply chain attack vector.
The operational impact of this vulnerability extends beyond simple privilege escalation to encompass potential full system compromise of Axis surveillance devices. When exploited, the path traversal attack could allow an attacker to access sensitive system files, modify critical configuration parameters, or even install persistent backdoors that maintain access across device reboots. The vulnerability affects the core application installation mechanism of ACAP, which is designed to provide extended functionality for Axis devices through third-party applications. This creates a dangerous scenario where legitimate device functionality becomes a vector for malicious activity, particularly when devices are deployed in security-sensitive environments where surveillance equipment serves as a critical component of overall security infrastructure. The attack surface is particularly concerning in enterprise environments where Axis devices are often deployed without proper security hardening, making the exploitation conditions more likely to be met in real-world scenarios.
The exploitation of this vulnerability requires an attacker to leverage social engineering tactics to convince victims to install malicious ACAP applications, which aligns with ATT&CK framework technique T1059 Command and Scripting Interpreter and T1566 Phishing. The attack chain begins with initial access through malicious application installation, followed by privilege escalation to gain elevated system permissions. Security professionals should note that this vulnerability demonstrates the importance of proper input validation in all application components, particularly those handling user-supplied data or configuration files. The requirement for unsigned application installation to be enabled creates a configuration management issue where device administrators must properly secure their systems against unauthorized application installation. Organizations should implement strict application control policies and ensure that ACAP application installation is restricted to trusted sources only, as this vulnerability highlights the danger of overly permissive security configurations that enable malicious actors to exploit legitimate application installation mechanisms. The vulnerability also underscores the need for comprehensive security testing of application installation and execution processes, particularly in embedded systems where such mechanisms may be less rigorously validated than in traditional software environments.