Heap-based buffer overflow in Axis A1001 Network Door Controller's OSDP communication

published 2023-07-25 3 y ago modified 2026-06-17 4 mo ago also EUVD-2023-25574

cvss: 7.1; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.3%; EPSS 0.3% chance of exploitation in 30 days, percentile 23%
public exploits: 0; none known

Ariel Harush and Roy Hodir from OTORIO have found a flaw in the AXIS A1001 when communicating over OSDP. A heap-based buffer overflow was found in the pacsiod process which is handling the OSDP communication allowing to write outside of the allocated buffer. By appending invalid data to an OSDP message it was possible to write data beyond the heap allocated buffer. The data written outside the buffer could be used to execute arbitrary code.

lease refer to the Axis security advisory for more information, mitigation and affected products and software versions.

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

cisa ICSA-23-206-01 updated 2023-07-25 cvss 7.1

AXIS A1001

Axis Communications AXIS A1001 <= 1.65.4
affected: vendor fix, mitigation “Axis has released a patched version for affected devices that fixes the vulnerability.” axis.com

From CISA ICS and IT advisories (CSAF, https://github.com/cisagov/CSAF), a U.S. Government work; changed: reduced to products, statuses and remediations. CISA notification · csaf

CISA SSVC

Exploitation: none
Automatable: no
Technical impact: partial
Assessed: 2 y ago (2024-10-18)

Exploit prediction

0.31% chance of exploitation in the next 30 days, higher than 23% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CNA	3.1	7.1	CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:H
NVD	3.1	8.8	CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

Axis Communications AB AXIS A1001 Network Door Controller

Classification

Weakness

CWE-122 Heap-based Buffer Overflow
CWE-120 Buffer Copy without Checking Size of Input
CWE-787 Out-of-bounds Write

References

axis.com /dam/public/1b/21/5f/cve-2023-21406-en-US-407245.pdf
vendor-advisory

Sources

CVE List CVE-2023-21406
NVD CVE-2023-21406

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary