AXIS Camera Station Flaw CVE-2026-13312 With CVSS 9.9 Could Let Attackers Compromise a System

Entenda a falha

A vulnerabilidade

CVE-2026-13312 (CVSS 9.9, critical) is an improper validation of input type (CWE-1287) in AXIS Camera Station. It is reachable over the network, needs only a low-privileged account and no user interaction, and has changed scope, so damage can spread beyond the application. Axis says it could let an attacker compromise a system. Affected: Camera Station Pro 6.0 to 6.17 and Camera Station 5 before 5.59 SR2. Fixed in Pro 6.18 and Camera Station 5 5.59 SR2. The article says 6.17 fixes only this critical bug, so 6.18 is the recommended build. Of the other 14 flaws, CVE-2026-8372 (8.8) is missing authentication in Camera Station Pro. CVE-2026-4762 (8.8) lets a non-admin user escalate privileges on the server. CVE-2026-12389 (8.4) is unsafe deserialization that lets a high-privileged user run code. CVE-2026-63288 (8.3) is a WebSocket authentication bypass on Axis door controllers. CVE-2026-12964 and CVE-2026-12963 let viewer accounts gain admin rights or reach NAS storage.

Como funciona

Axis will not publish details of CVE-2026-13312, so the exact flow is not public. From the CWE classification, an authenticated low-privileged user sends input to the Camera Station server over the network. The software does not properly check that the input is of the type it expects, and then processes it anyway. That failure lets the request affect the system beyond the permissions of the account, which is why the scope is rated as changed.

Por que é vulnerável

The root cause of CVE-2026-13312 is improper validation of the type of input (CWE-1287): the code accepts data without confirming it is the expected type. Axis has not given more detail, and the articles do not say why it went unnoticed or what exactly the patch changes. For the other flaws, the articles name missing authentication, unsafe deserialization and a WebSocket authentication bypass as causes.

Como foi descoberta

Ryan Vinton found the critical bug through the AXIS Camera Station Pro bug bounty program. Axis disclosed 15 vulnerabilities in total on November 10, 2026, in an advisory covering AXIS Camera Station, AXIS OS and related tools. The company says no known exploits exist publicly and that it is not aware of exploitation. The articles do not say when the report was made.

Explicação gerada por IA a partir da matéria e dos artigos, em 10/11/2026 23:15.