CVE-2023-5677 is a medium severity (CVSS 6.3) command injection flaw in the VAPIX tcptest.cgi API on older Axis devices. It can be used only after signing in with an operator or administrator service account. Axis lists patched firmware per product, and says unsupported devices will not be patched.
What's affected
- Product: Axis network devices running firmware 5.50 through 5.51, and AXIS OS 6.50.0 through 6.50.5.20.
- Fixed: 5.51.7.7 for AXIS M3024-L, M3025-VE, M7014, M7016, P1214(-E), P7214, P7216, Q7401, Q7404 and Q7414. 5.51.3.9 for the Q7424-R Mk II. 6.50.5.21 for former LTS products still under software support.
- Not patched: affected products whose software support has expired will not receive a patch, according to Axis.
- Severity: 6.3 Medium (CVSS 3.1), the same score in the NVD record and the Axis advisory.
- Axis says it knows of no public exploit and is not aware of exploitation. No out-of-band release was issued because of the low impact.
How to check if you're exposed
Read the firmware version from each device's web interface or from your device management tool, then match the model against the patched list above. For a fleet, export the model and firmware columns from your management software and compare them with the versions in the advisory.
Also list who holds operator or administrator service accounts on each device. The flaw needs one of those roles, so account hygiene is part of the exposure check.
What to do now
- Update each supported device to the patched firmware listed in the Axis advisory, or to the latest release for its track.
- For devices past the end of software support, plan replacement. Axis says they will not get a patch.
- Limit network access to device web interfaces to a management network. Cameras should not be reachable from the internet.
- Review operator and administrator accounts, remove unused ones, and use strong unique passwords.
- Record models and firmware versions so the next advisory is quick to map.
Why it matters
The advisory says the tcptest.cgi endpoint did not validate its input enough, and the record maps this to CWE-78, OS command injection, together with CWE-94, code injection. Input that should be a plain test parameter instead reaches something that interprets it as a command. Axis says the impact is lower with operator privileges than with administrator privileges.
The requirement for a privileged account lowers the score, but it does not remove the risk. Camera fleets often share credentials, and an attacker who already has one set can turn a management foothold into code execution on the device itself. The CVE is not in the CISA Known Exploited Vulnerabilities catalog. Axis does not publish further technical detail, and neither does this post.
Quick check
My camera is out of support. What now?
Axis says affected products with expired software support will not receive a patch. Isolate them on a restricted network and plan to replace them.
Sources
Last reviewed: 19 October 2026.
