CVE-2023-21414 : NCC Group has found a flaw during the annual internal penetration test ordered b

NCC Group has found a flaw during the annual internal penetration test ordered by Axis Communications. The protection for device tampering (commonly known as Secure Boot) contains a flaw which provides an opportunity for a sophisticated attack to bypass this protection. Axis has released patched AXIS OS versions for the highlighted flaw. Please refer to the Axis security advisory for more information and solution.

Published 2023-10-16 07:15:09

Updated 2024-11-08 09:15:06

Source Axis Communications AB

View at NVD, CVE.org

Products affected by CVE-2023-21414

Axis » Axis Os » Active Edition
Versions before (<) 11.6.94
cpe:2.3:o:axis:axis_os:*:*:*:*:active:*:*:*
Matching versions
When used together with: Axis » A8207-ve Mk Ii » Version: N/A
Axis » Axis Os » Active Edition
Versions from including (>=) 11.0.89 and before (<) 11.6.94
cpe:2.3:o:axis:axis_os:*:*:*:*:active:*:*:*
Matching versions
When used together with: Axis » M3215 » Version: N/A
When used together with: Axis » M3216 » Version: N/A
When used together with: Axis » M4317-plve » Version: N/A
When used together with: Axis » M4318-plve » Version: N/A
When used together with: Axis » M4327-p » Version: N/A
When used together with: Axis » M4328-p » Version: N/A
When used together with: Axis » P1467-le » Version: N/A
When used together with: Axis » P1468-le » Version: N/A
When used together with: Axis » P1468-xle » Version: N/A
When used together with: Axis » P3265-lv » Version: N/A
When used together with: Axis » P3265-lve » Version: N/A
When used together with: Axis » P3265-v » Version: N/A
When used together with: Axis » P3267-lv » Version: N/A
When used together with: Axis » P3267-lve » Version: N/A
When used together with: Axis » P3268-lv » Version: N/A
When used together with: Axis » P3268-lve » Version: N/A
When used together with: Axis » P3827-pve » Version: N/A
When used together with: Axis » P4705-plve » Version: N/A
When used together with: Axis » P4707-plve » Version: N/A
When used together with: Axis » Q1656 » Version: N/A
When used together with: Axis » Q1656-b » Version: N/A
When used together with: Axis » Q1656-be » Version: N/A
When used together with: Axis » Q1656-ble » Version: N/A
When used together with: Axis » Q1656-dle » Version: N/A
When used together with: Axis » Q1656-le » Version: N/A
When used together with: Axis » Q1961-te » Version: N/A
When used together with: Axis » Q2101-te » Version: N/A
When used together with: Axis » Q3536-lve » Version: N/A
When used together with: Axis » Q3538-lve » Version: N/A
When used together with: Axis » Q3626-ve » Version: N/A
When used together with: Axis » Q3628-ve » Version: N/A
When used together with: Axis » Xfq1656 » Version: N/A
Axis » Axis Os
Versions from including (>=) 10.11.55 and before (<) 10.12.206
cpe:2.3:o:axis:axis_os:*:*:*:*:*:*:*:*
Matching versions
When used together with: Axis » M3215 » Version: N/A
When used together with: Axis » M3216 » Version: N/A
When used together with: Axis » M4317-plve » Version: N/A
When used together with: Axis » M4318-plve » Version: N/A
When used together with: Axis » M4327-p » Version: N/A
When used together with: Axis » M4328-p » Version: N/A
When used together with: Axis » P1467-le » Version: N/A
When used together with: Axis » P1468-le » Version: N/A
When used together with: Axis » P1468-xle » Version: N/A
When used together with: Axis » P3265-lv » Version: N/A
When used together with: Axis » P3265-lve » Version: N/A
When used together with: Axis » P3265-v » Version: N/A
When used together with: Axis » P3267-lv » Version: N/A
When used together with: Axis » P3267-lve » Version: N/A
When used together with: Axis » P3268-lv » Version: N/A
When used together with: Axis » P3268-lve » Version: N/A
When used together with: Axis » P3827-pve » Version: N/A
When used together with: Axis » P4705-plve » Version: N/A
When used together with: Axis » P4707-plve » Version: N/A
When used together with: Axis » Q1656 » Version: N/A
When used together with: Axis » Q1656-b » Version: N/A
When used together with: Axis » Q1656-be » Version: N/A
When used together with: Axis » Q1656-ble » Version: N/A
When used together with: Axis » Q1656-dle » Version: N/A
When used together with: Axis » Q1656-le » Version: N/A
When used together with: Axis » Q1961-te » Version: N/A
When used together with: Axis » Q2101-te » Version: N/A
When used together with: Axis » Q3536-lve » Version: N/A
When used together with: Axis » Q3538-lve » Version: N/A
When used together with: Axis » Q3626-ve » Version: N/A
When used together with: Axis » Q3628-ve » Version: N/A
When used together with: Axis » Xfq1656 » Version: N/A

Exploit prediction scoring system (EPSS) score for CVE-2023-21414

EPSS FAQ

0.37%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 73 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2023-21414

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
6.8	MEDIUM	CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	0.9	5.9	NIST
Attack Vector: Physical Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: High Integrity: High Availability: High
7.1	HIGH	CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H	0.5	6.0	Axis Communications AB
Attack Vector: Physical Attack Complexity: High Privileges Required: None User Interaction: None Scope: Changed Confidentiality: High Integrity: High Availability: High

CWE ids for CVE-2023-21414

CWE-121 Stack-based Buffer Overflow

A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function).

Assigned by: product-security@axis.com (Secondary)

References for CVE-2023-21414

https://www.axis.com/dam/public/45/3c/a1/cve-2023-21414pdf-en-US-412758.pdf

Vendor Advisory

Jump to

Vulnerability Details : CVE-2023-21414

Products affected by CVE-2023-21414

Exploit prediction scoring system (EPSS) score for CVE-2023-21414

CVSS scores for CVE-2023-21414

CWE ids for CVE-2023-21414

References for CVE-2023-21414