CVE-2026-1185

A configuration file on the local file system had improper input validation which could allow code execution and potentially lead to privilege escalation. This vulnerability can only be exploited if an attacker can log in to the Axis device using SSH.

CVSS v3 5.4 MEDIUM

5.4^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 2.5

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact LOW

Scope UNCHANGED

References

Link	Resource
https://www.axis.com/dam/public/69/df/8d/cve-2026-1185pdf-en-US-530733.pdf	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:o:axis:axis_os:*:*:*:*:active:*:*:*

History

26 Oct 2026, 18:10

Type	Values Removed	Values Added
Summary		(es) Un archivo de configuración en el sistema de archivos local tenía una validación de entrada incorrecta que podría permitir la ejecución de código y potencialmente conducir a la escalada de privilegios. Esta vulnerabilidad solo puede ser explotada si un atacante puede iniciar sesión en el dispositivo Axis usando SSH.

Information

Published : 2026-05-12 07:16

Updated : 2026-10-26 18:10

NVD link : CVE-2026-1185

Mitre link : CVE-2026-1185

CVE.ORG link : CVE-2026-1185

JSON object : View

Products Affected

axis

axis_os

CWE

CWE-732

Incorrect Permission Assignment for Critical Resource

{"id": "CVE-2026-1185", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-1185", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-05-12T00:00:00+00:00"}}], "cvssMetricV31": [{"type": "Secondary", "source": "product-security@axis.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 2.5, "exploitabilityScore": 2.8}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}]}, "affected": [{"source": "product-security@axis.com", "affectedData": [{"vendor": "Axis Communications AB", "product": "AXIS OS", "versions": [{"status": "affected", "version": "12.0.0", "lessThan": "12.10.36", "versionType": "semver"}], "defaultStatus": "unaffected"}]}], "published": "2026-05-12T07:16:09.720", "references": [{"url": "https://www.axis.com/dam/public/69/df/8d/cve-2026-1185pdf-en-US-530733.pdf", "tags": ["Vendor Advisory"], "source": "product-security@axis.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "product-security@axis.com", "description": [{"lang": "en", "value": "CWE-732"}]}], "descriptions": [{"lang": "en", "value": "A configuration file on the local file system had improper input validation which could allow code execution and potentially lead to privilege escalation. This vulnerability can only be exploited if an attacker can\u00a0log in to the Axis device using SSH."}, {"lang": "es", "value": "Un archivo de configuraci\u00f3n en el sistema de archivos local ten\u00eda una validaci\u00f3n de entrada incorrecta que podr\u00eda permitir la ejecuci\u00f3n de c\u00f3digo y potencialmente conducir a la escalada de privilegios. Esta vulnerabilidad solo puede ser explotada si un atacante puede iniciar sesi\u00f3n en el dispositivo Axis usando SSH."}], "lastModified": "2026-10-26T18:10:00.173", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:axis:axis_os:*:*:*:*:active:*:*:*", "vulnerable": true, "matchCriteriaId": "3CD3401A-1B20-4192-9B1D-90FDC768689E", "versionEndExcluding": "12.10.37", "versionStartIncluding": "12.0.0"}], "operator": "OR"}]}], "sourceIdentifier": "product-security@axis.com"}