CVE-2023-5800 is a medium severity (CVSS 5.4) code injection flaw in the VAPIX create_overlay.cgi API of AXIS OS, versions 6.50 through 11.7. Exploitation needs an operator or administrator service account. Axis has patched releases on several tracks, and lists no known exploits.
What's affected
- Product: AXIS OS, versions 6.50 through 11.7.
- Fixed: Active Track 11.8.61, LTS 2022 10.12.220, LTS 2020 9.80.55, and former LTS releases 8.40.40 and 6.50.5.16 for products still under software support.
- Other devices: those not on these tracks but still supported will get a patch under their planned maintenance schedule, according to Axis.
- Severity: 5.4 Medium (CVSS 3.1), the same in the NVD record and the Axis advisory.
- Credit: Axis credits Vintage, a member of its AXIS OS Bug Bounty Program. Axis says there are no known exploits.
How to check if you're exposed
Open each device's web interface or your device management tool and read the AXIS OS version. Match it against the fixed versions for its track. For example, a device on the 10.12 LTS track needs 10.12.220 or later.
Then list operator and administrator service accounts on each device. The advisory says the flaw can only be used after authenticating with one of those roles.
What to do now
- Update each supported device to the fixed release for its track, or to the current Active Track release.
- Plan to replace devices that no longer receive software updates.
- Keep device web interfaces off the internet and behind a management network or VPN.
- Remove unused operator and administrator accounts and replace shared credentials with unique ones.
- Keep a model and firmware inventory so the next Axis advisory is quick to map.
Why it matters
The advisory says the create_overlay.cgi endpoint did not validate its input well enough, which could allow remote code execution once a privileged user is signed in. The record maps the weakness to CWE-94, improper control of code generation, and CWE-35, a path traversal pattern. Axis does not publish more detail on purpose, and this post does not guess at it.
The privilege requirement is the main reason the score is moderate. It still deserves attention, because IP camera credentials are often reused across a fleet, and code execution on a camera gives an attacker a foothold inside a network, a place to watch from, and a device that rarely runs endpoint protection. The record does not list this CVE as known exploited, and Axis says it knows of no exploits.
Quick check
Does the same patch cover CVE-2023-5677?
They are separate Axis advisories with different affected and fixed lists. Check each advisory against your model and firmware track instead of assuming one update covers both.
Sources
Last reviewed: 19 October 2026.
