CVE-2023-21409

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Due to insufficient file permissions, unprivileged users could gain access to unencrypted administrator credentials allowing the configuration of the application.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-755

Affected software

Vendor	Product	Versions
Axis Communications AB	AXIS License Plate Verifier	2.8.3 or earlier

References

https://www.axis.com/dam/public/0b/1c/96/cve-2023-2140712-en-US-409778.pdfVendor Advisory
https://www.axis.com/dam/public/0b/1c/96/cve-2023-2140712-en-US-409778.pdfVendor Advisory

Timeline

Published: Aug 3, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-21418.8An unsafe .NET object deserialization in DELMIA Apriso Release 2017 through Release 2022 could lead to post-authentication remote code execu CVE-2023-214108.8User provided input is not sanitized on the AXIS License Plate Verifier specific “api.cgi” allowing for arbitrary code execution.CVE-2023-214118.8User provided input is not sanitized in the “Settings > Access Control” configuration interface allowing for arbitrary code execution.CVE-2023-214128.8User provided input is not sanitized on the AXIS License Plate Verifier specific “search.cgi” allowing for SQL injections.CVE-2023-214137.2GoSecure on behalf of Genetec Inc. has found a flaw that allows for a remote code execution during the installation of ACAP applications on CVE-2023-214146.8NCC Group has found a flaw during the annual internal penetration test ordered by Axis Communications. The protection for device tampering (CVE-2023-214158.1Sandro Poppi, member of the AXIS OS Bug Bounty Program, has found that the VAPIX API overlay_del.cgi is vulnerable to path traversal attacks CVE-2023-214166.5Sandro Poppi, member of the AXIS OS Bug Bounty Program, has found that the VAPIX API dynamicoverlay.cgi was vulnerable to a Denial-of-Servic CVE-2023-214177.1Sandro Poppi, member of the AXIS OS Bug Bounty Program, has found that the VAPIX API manageoverlayimage.cgi was vulnerable to path traversa CVE-2023-214187.1Sandro Poppi, member of the AXIS OS Bug Bounty Program, has found that the VAPIX API irissetup.cgi was vulnerable to path traversal attacks CVE-2023-214197.5An improper implementation logic in Secure Folder prior to SMR Jan-2023 Release 1 allows the Secure Folder container remain unlocked under c CVE-2023-21426.1In Nunjucks versions prior to version 3.2.4, it was possible to bypass the restrictions which are provided by the autoescape functionality