« Volver al listado

CVE-2024-47257

Estado: AplazadaAlta (7.5)—

Florent Thiéry has found that selected Axis devices were vulnerable to handling certain ethernet frames which could lead to the Axis device becoming unavailable in the network. Axis has released patched AXIS OS versions for the highlighted flaw for products that are still under AXIS OS software support. Please refer to the Axis security advisory for more information and solution.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

Vector CVSS de red sin autenticación (AV:N/PR:N/UI:N) + disponibilidad comprometida (A:H) indica denegación de servicio remota. El CWE-1284 (improper neutralization of special elements) sugiere procesamiento de tramas Ethernet malformadas → T1190 + T1499.004 (flood de red).

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Filter Network TrafficVulnerability ScanningPrivileged Account ManagementNetwork SegmentationLimit Access to Resource Over NetworkApplication Isolation and Sandboxing

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Axis — Axis OSAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2024-47257",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-47257",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-11-26T14:49:53.871536Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "product-security@axis.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.5,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "product-security@axis.com",
      "affectedData": [
        {
          "vendor": "Axis Communications AB",
          "product": "AXIS Q6128-E PTZ Network Camera",
          "versions": [
            {
              "status": "affected",
              "version": "6.50"
            }
          ],
          "platforms": [
            "Linux"
          ],
          "defaultStatus": "unaffected"
        },
        {
          "vendor": "Axis Communications AB",
          "product": "AXIS P1428-E Network Camera",
          "versions": [
            {
              "status": "affected",
              "version": "6.50"
            }
          ],
          "platforms": [
            "Linux"
          ],
          "defaultStatus": "unaffected"
        }
      ]
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "affectedData": [
        {
          "cpes": [
            "cpe:2.3:a:axis_communications_ab:axis_q6128-e_ptz_network_camera:*:*:*:*:*:*:*:*"
          ],
          "vendor": "axis_communications_ab",
          "product": "axis_q6128-e_ptz_network_camera",
          "versions": [
            {
              "status": "affected",
              "version": "6.50"
            }
          ],
          "defaultStatus": "unknown"
        },
        {
          "cpes": [
            "cpe:2.3:a:axis_communications_ab:axis_p1428-e_network_camera:*:*:*:*:*:*:*:*"
          ],
          "vendor": "axis_communications_ab",
          "product": "axis_p1428-e_network_camera",
          "versions": [
            {
              "status": "affected",
              "version": "6.50"
            }
          ],
          "defaultStatus": "unknown"
        }
      ]
    }
  ],
  "published": "2024-11-26T08:15:07.583",
  "references": [
    {
      "url": "https://www.axis.com/dam/public/b7/76/b2/cve-2024-47257pdf-en-US-458044.pdf",
      "source": "product-security@axis.com"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "product-security@axis.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-1284"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Florent Thiéry has found that selected Axis devices were vulnerable to handling certain ethernet frames which could lead to the Axis device becoming unavailable in the network. \nAxis has released patched AXIS OS versions for the highlighted flaw for products that are still under AXIS OS software support. Please refer to the Axis security advisory for more information and solution."
    },
    {
      "lang": "es",
      "value": "Florent Thiéry ha descubierto que determinados dispositivos Axis eran vulnerables a la gestión de determinadas tramas Ethernet, lo que podía provocar que el dispositivo Axis no estuviera disponible en la red. Axis ha publicado versiones parcheadas del sistema operativo AXIS para la falla destacada para los productos que todavía cuentan con soporte de software AXIS OS. Consulte el aviso de seguridad de Axis para obtener más información y soluciones."
    }
  ],
  "lastModified": "2026-06-17T07:56:47.620",
  "sourceIdentifier": "product-security@axis.com"
}