Denial-of-Service vulnerability in Axis Network Door Controller's and Axis Network Intercom's OSDP communication

published 2023-07-25 3 y ago modified 2026-06-17 4 mo ago also EUVD-2023-25573

cvss: 6.5; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.3%; EPSS 0.3% chance of exploitation in 30 days, percentile 22%
public exploits: 0; none known

Knud from Fraktal.fi has found a flaw in some Axis Network Door Controllers and Axis Network Intercoms when communicating over OSDP, highlighting that the OSDP message parser crashes the pacsiod process, causing a temporary unavailability of the door-controlling functionalities meaning that doors cannot be opened or closed. No sensitive or customer data can be extracted as the Axis device is not further compromised. Please refer to the Axis security advisory for more information, mitigation and affected products and software versions.

CISA SSVC

Exploitation: none
Automatable: no
Technical impact: partial
Assessed: 2 y ago (2024-10-15)

Exploit prediction

0.30% chance of exploitation in the next 30 days, higher than 22% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CNA	3.1	6.5	CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
NVD	3.1	6.5	CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected products

Axis Communications AB AXIS A1001 Network Door Controller
Axis Communications AB AXIS A1210-B Network Door Controller
Axis Communications AB AXIS A1601 Network Door Controller
Axis Communications AB AXIS A1610 (-B) Network Door Controller
Axis Communications AB AXIS A8207-VE Network Video Door Station
Axis Communications AB AXIS A8207-VE Mk II Network Video Door Station

Classification

Weakness

CWE-1286 Improper Validation of Syntactic Correctness of Input
CWE-754 Improper Check for Unusual or Exceptional Conditions

References

axis.com /dam/public/7f/3a/ed/cve-2023-21405-en-US-407244.pdf
vendor-advisory

Sources

CVE List CVE-2023-21405
NVD CVE-2023-21405

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary