Axis Camera Station critical flaw CVE-2026-13312 (CVSS 9.9) allows remote code execution; patches released
Matéria consolidada. Reúne 2 matérias que o Tifon tinha publicado separadamente sobre a mesma história. A IA reescreveu o relatório com o que as 2 fontes trouxeram em 14/11/2026 00:00; os links antigos trazem para cá.
Axis Communications disclosed 15 vulnerabilities affecting AXIS Camera Station, AXIS OS and related tools (securityonline.info). The most severe, CVE-2026-13312, is scored CVSS 9.9. It is described as an improper input validation flaw that a low-privileged attacker could abuse without user interaction (securityonline.info). CERT-FR classifies it as a remote code execution (RCE) vulnerability in Axis Camera Station Pro and Axis Camera Station that allows arbitrary code execution on affected systems (cert.cyber.gouv.fr). Impact could extend to live feeds, recordings and the surrounding network (securityonline.info). Neither source reports exploitation in the wild. Both urge immediate patching.
Entenda a falha
A vulnerabilidade
CVE-2026-13312 (CVSS 9.9) is an improper input type validation flaw (CWE-1287) in AXIS Camera Station Pro 6.0 to 6.17 and AXIS Camera Station 5 before 5.59 SR2. It works over the network, needs only a low-privileged account and no user interaction, and changes scope. CERT-FR describes it as remote arbitrary code execution, which could expose live feeds, recordings and the surrounding network. Fixes: Camera Station 5.59 SR2 and Pro 6.18 per securityonline.info, while CERT-FR lists versions before 6.17 as affected. Axis' advisory is the reference. Other CVEs in the same batch: CVE-2026-8372 (missing authentication in Pro, 8.8), CVE-2026-4762 (privilege escalation by a non-admin, 8.8), CVE-2026-12389 (unsafe deserialization, RCE by a high-privileged user, 8.4), CVE-2026-63288 (WebSocket authentication bypass on door controllers, 8.3) and CVE-2026-12964/12963 (viewer accounts gaining admin rights or NAS access).
Como funciona
The articles do not describe the vulnerable process. Axis says it will not provide more detailed information. All that is known is that the software receives input over the network from an account with low privileges and does not properly validate its type, and that this can lead to code execution that spreads beyond the application itself.
Por que é vulnerável
The root cause is classified as improper validation of input type (CWE-1287): the software does not properly check that the input it receives is of the expected type. The articles say nothing about why it went unnoticed or what exactly the fix changes, since Axis withholds details.
Como foi descoberta
According to securityonline.info, researcher Ryan Vinton found the critical bug through the AXIS Camera Station Pro bug bounty program. Axis disclosed 15 vulnerabilities on November 10, 2026, while CERT-FR cites an Axis bulletin dated November 13, 2026. Axis says no public exploits exist and it is not aware of exploitation.
Explicação gerada por IA a partir da matéria e dos artigos, em 14/11/2026 00:16.
Detalhes técnicos
- Root cause: improper input validation (securityonline.info).
- Severity: CVSS 9.9. Exploitation requires low privileges and no user interaction (securityonline.info).
- Impact: arbitrary remote code execution (cert.cyber.gouv.fr). Live video, recordings and the connected network are at risk (securityonline.info).
- Affected products: AXIS Camera Station Pro versions prior to 6.17 and AXIS Camera Station versions prior to 5.59 SR 2 (cert.cyber.gouv.fr).
- The 15-vulnerability count, which also covers AXIS OS, comes only from securityonline.info. CERT-FR addresses only CVE-2026-13312.
Remediação
- Apply the Axis patches immediately. Fixed versions are AXIS Camera Station Pro 6.18 and AXIS Camera Station 5.59 SR2 (securityonline.info). CERT-FR refers to the Axis security bulletin dated November 13, 2026 (cert.cyber.gouv.fr).
- Until patched, limit access to the management systems and the low-privileged accounts that could trigger the flaw. This is general guidance, not stated in the sources.
Relatos divergentes
- Fixed version for Pro: securityonline.info cites 6.18, while cert.cyber.gouv.fr lists versions prior to 6.17 as affected. The two figures are not clearly reconciled. Check the Axis advisory, which is the vendor source, and treat the latest release as safe.
- Bulletin date: securityonline.info reported the disclosure on November 11, 2026, while cert.cyber.gouv.fr (published November 13, the more recent source) refers to an Axis bulletin dated November 13, 2026.
- Characterization: securityonline.info stresses low-privilege takeover from input validation, while cert.cyber.gouv.fr describes unauthenticated-style remote code execution without mentioning privileges. These descriptions may overlap but are not identical.
Linha do tempo
-
Remote Code Execution Vulnerability in Axis Camera Station Pro and Axis Camera Station
ler a análise desta fonte ocultar
A critical remote code execution (RCE) vulnerability, identified as CVE-2026-13312, has been discovered in Axis Camera Station pro versions prior to 6.17 and Axis Camera Station versions prior to 5.59 SR 2. This flaw allows an attacker to execute arbitrary code remotely on affected systems. Users are strongly advised to apply patches released by Axis as detailed in their security bulletin dated November 13, 2026. Immediate updating is necessary to mitigate exploitation risks. The vulnerability was officially disclosed by CERT-FR referencing Axis' security advisory and the CVE record.
-
Axis CVE-2026-13312 flaw could let attackers take over Axis Camera Station systems
ler a análise desta fonte ocultar
Axis Communications disclosed 15 vulnerabilities affecting AXIS Camera Station, AXIS OS, and related tools. The most critical, CVE-2026-13312, scores 9.9 on CVSS and could allow an attacker with low privileges to compromise the system without user interaction. This vulnerability stems from improper input validation and can impact live feeds, recordings, and the surrounding network. Axis has issued patches in versions 6.18 (for AXIS Camera Station Pro) and 5.59 SR2, urging immediate updates.