{"id":"CVE-2017-20049","aliases":["EUVD-2017-11064","GHSA-mh3r-vrg4-68p4"],"status":"published","title":"A vulnerability, which was classified as critical, was found in AXIS P1204, P3225, P3367, M3045,...","description":"A vulnerability, was found in legacy Axis devices such as P3225 and M3005. This affects an unknown part of the component CGI Script. The manipulation leads to improper privilege management. It is possible to initiate the attack remotely.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.01583,"percentile":0.75729,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-269"],"published":"2022-06-15T17:35:25Z","modified":"2026-06-17T01:14:59Z","products":[{"vendor":"axis","product":"m3005_firmware"},{"vendor":"axis","product":"m3007_firmware"},{"vendor":"axis","product":"m3045_firmware"},{"vendor":"axis","product":"p1204_firmware"},{"vendor":"axis","product":"p3225_firmware"},{"vendor":"axis","product":"p3367_firmware"},{"vendor":"axis communications ab","product":"axis os"}],"references":[{"url":"https://www.axis.com/dam/public/df/f3/dd/cve-2017-20049-en-US-376956.pdf","tags":["x_refsource_MISC","x_transferred"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-20049"},{"url":"https://vuldb.com/?id.98913"},{"url":"http://seclists.org/fulldisclosure/2017/Mar/41"},{"url":"https://github.com/advisories/GHSA-mh3r-vrg4-68p4"}],"sources":{"cve":[{"id":"CVE-2017-20049","description":"A vulnerability, was found in legacy Axis devices such as P3225 and M3005. This affects an unknown part of the component CGI Script. The manipulation leads to improper privilege management. It is possible to initiate the attack remotely.","status":"published","published":"2022-06-15T17:35:25Z","modified":"2024-08-05T21:45:25.224Z","updated_at":"2026-11-02T14:33:11.928814Z"}],"euvd":[{"id":"EUVD-2017-11064","description":"A vulnerability, was found in legacy Axis devices such as P3225 and M3005. This affects an unknown part of the component CGI Script. The manipulation leads to improper privilege management. It is possible to initiate the attack remotely.","status":"published","published":"2022-06-15T17:35:25Z","modified":"2024-08-05T21:45:25Z","updated_at":"2026-11-03T02:23:04.143753Z"}],"ghsa":[{"id":"GHSA-mh3r-vrg4-68p4","title":"A vulnerability, which was classified as critical, was found in AXIS P1204, P3225, P3367, M3045,...","description":"A vulnerability, which was classified as critical, was found in AXIS P1204, P3225, P3367, M3045, M3005 and M3007. This affects an unknown part of the component CGI Script. The manipulation leads to improper privilege management. It is possible to initiate the attack remotely. It is recommended to upgrade the affected component.","status":"published","published":"2022-06-16T00:00:22Z","modified":"2023-01-28T05:06:34Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-269"],"updated_at":"2026-11-02T14:44:26.876971Z"}],"nvd":[{"id":"CVE-2017-20049","description":"A vulnerability, was found in legacy Axis devices such as P3225 and M3005. This affects an unknown part of the component CGI Script. The manipulation leads to improper privilege management. It is possible to initiate the attack remotely.","status":"published","published":"2022-06-15T18:15:08.47Z","modified":"2026-06-17T01:14:59.64Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"2.0","score":10,"vector":"AV:N/AC:L/Au:N/C:C/I:C/A:C","level":"high","assessor":"primary"}],"cwes":["CWE-269"],"updated_at":"2026-11-02T14:04:21.492973Z"}]}}