CVE-2024-47259: Axis OS Command Injection RCE Vulnerability

CVE-2024-47259 Overview

CVE-2024-47259 affects the VAPIX API dynamicoverlay.cgi endpoint in Axis OS. The endpoint fails to perform sufficient input validation, enabling command injection. An authenticated attacker with low privileges can abuse this flaw to transfer files onto the Axis device and exhaust system resources. The issue is tracked under [CWE-434] (Unrestricted Upload of File with Dangerous Type). Axis has released patched AXIS OS versions to address the flaw.

Critical Impact
Authenticated attackers can inject commands through dynamicoverlay.cgi to push files onto the device and exhaust system resources, degrading availability of the Axis camera or appliance.

Affected Products

Axis AXIS OS (active track)
Axis AXIS OS 2024 (LTS track)
Devices exposing the VAPIX dynamicoverlay.cgi endpoint

Discovery Timeline

Vulnerability reported by Girishunawane through the AXIS OS Bug Bounty Program
2025-03-04 - CVE-2024-47259 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-47259

Vulnerability Analysis

The flaw resides in the VAPIX API handler dynamicoverlay.cgi, which processes overlay configuration requests on Axis devices. The handler does not sufficiently validate user-supplied input before passing it to downstream operations. This gap allows an authenticated attacker to inject command syntax and trigger file transfers onto the device. The result is resource exhaustion that impacts the availability of the camera or embedded appliance.

Root Cause

The underlying weakness is improper input validation in the dynamicoverlay.cgi CGI handler. Parameters accepted by the endpoint are not sanitized against shell metacharacters or file upload constraints. Axis classifies the issue under [CWE-434], indicating that untrusted input influences file handling operations on the device.

Attack Vector

Exploitation requires network access to the VAPIX interface and valid low-privileged credentials on the target device. An attacker crafts a malicious request to dynamicoverlay.cgi that abuses the missing validation to push files onto the device filesystem. Repeated or oversized transfers consume storage and system resources, degrading the availability of the device. The vulnerability does not require user interaction.

No public proof-of-concept code is available. Refer to the Axis Security Advisory CVE-2024-47259 for vendor technical detail.

Detection Methods for CVE-2024-47259

Indicators of Compromise

Unexpected HTTP requests targeting dynamicoverlay.cgi from unusual source addresses or accounts
Sudden growth in device storage utilization or file system exhaustion alerts on Axis endpoints
Repeated authenticated VAPIX API calls from a single operator account outside normal maintenance windows

Detection Strategies

Inspect VAPIX access logs for POST or GET requests to dynamicoverlay.cgi containing shell metacharacters such as ;, |, &, or backticks
Correlate authentication events with subsequent large file transfers or configuration changes on Axis devices
Alert on device-side errors reporting resource exhaustion, failed writes, or degraded services following API activity

Monitoring Recommendations

Forward Axis device syslog and VAPIX audit logs to a centralized SIEM for behavioral baselining
Monitor network flows to camera management VLANs for anomalous HTTPS payload sizes
Track use of operator-level credentials against device inventories to identify credential misuse

How to Mitigate CVE-2024-47259

Immediate Actions Required

Upgrade affected Axis devices to the patched AXIS OS versions listed in the vendor advisory
Restrict network access to VAPIX interfaces so only trusted management hosts can reach them
Rotate credentials on Axis devices and remove unused operator or administrator accounts

Patch Information

Axis has released patched AXIS OS versions for both the active track and the AXIS OS 2024 LTS track. Consult the Axis Security Advisory CVE-2024-47259 for the exact fixed builds mapped to each device model, and apply firmware updates through the standard Axis Device Manager workflow.

Workarounds

Place Axis devices on isolated management VLANs with strict ACLs limiting inbound VAPIX access
Disable or restrict low-privileged operator accounts that do not require VAPIX API usage
Enforce strong, unique credentials and enable HTTPS-only communication on all Axis endpoints

bash

# Configuration example: restrict VAPIX access at the perimeter
# Allow only the management host to reach the Axis device HTTPS interface
iptables -A FORWARD -s 10.10.20.5 -d 10.20.30.40 -p tcp --dport 443 -j ACCEPT
iptables -A FORWARD -d 10.20.30.40 -p tcp --dport 443 -j DROP