description: NCC Group has found a flaw during the annual internal penetration test ordered by Axis Communications. The protection for device tampering (commonly known as Secure Boot) contains a flaw which provides an opportunity for a sophisticated attack to bypass this protection. Axis has released patched AXIS OS versions for the highlighted flaw. Please refer to the Axis security advisory for more information and solution.
affected:
{
defaultStatus: unaffected
platforms: ARTPEC 8
product: AXIS OS
vendor: Axis Communications AB
versions:
status: affected, version: AXIS OS 10.11 - 11.5
}
{
defaultStatus: unaffected
product: AXIS A8207-VE Mk II
vendor: Axis Communications AB
versions:
status: affected, version: AXIS OS 11.5 or earlier
}
{
defaultStatus: unaffected
product: AXIS Q3527-LVE
vendor: Axis Communications AB
versions:
status: affected, version: AXIS OS 10.11 - 11.5
}
metrics:
cvssV3_1: [
attackComplexity: HIGH
attackVector: PHYSICAL
availabilityImpact: HIGH
baseScore: 7.1
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
version: 3.1
]
format: CVSS
scenarios: GENERAL