{"id":"CVE-2026-12963","kind":"vulnerability","aliases":["CVE-2026-12963"],"related":[],"title":"AXIS Camera Station: viewer account can reach network attached storage devices (fix not yet released)","description":"A vulnerability that could allow a viewer account to gain unauthorized access to network attached storage devices on the server.","summary":"A flaw lets a low-privilege viewer account gain access to network attached storage devices reachable from the server. An attacker with a viewer login could read or change data on those storage devices.","severity":"high","cvss":7.4,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"AXIS Camera Station","fixed":[],"affected":"unknown, Axis has not published versions","ecosystem":"vendor"}],"ecosystems":[],"tags":["axis","axis-camera-station","infrastructure","network-attached-storage","self-hosted","windows"],"not_affected_if":[],"how_to_check":"Check whether you run AXIS Camera Station (Pro or 5) and which version (Help > About in the client). Axis has not published affected versions yet; review the Axis security advisories page for the full advisory.","fix":"No patched version published yet: Axis lists the released version as TBA. Check the Axis advisory registry for the fixed AXIS Camera Station Pro release.","status":"open","published_at":"2026-11-10T06:17:08+00:00","first_seen_at":"2026-11-10T06:20:23+00:00","triaged_at":"2026-11-10T06:22:15+00:00","updated_at":"2026-11-10T06:24:50+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-11-10T06:22:15Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Viewer account can reach network attached storage devices unauthorized","impact":"medium","summary":"A flaw lets a low-privilege viewer account gain access to network attached storage devices reachable from the server. An attacker with a viewer login could read or change data on those storage devices.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["network-attached-storage"],"confidence":0.4,"fix_status":"unknown","needs_auth":"yes","worst_case":"viewer account reads or changes data on network storage","analyst_note":"Identify the affected product and its fixed versions from the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-12963.","how_to_check":"unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":[],"who_is_affected":"The sources do not name the affected product, so the exposed systems are unknown. Teams that run servers with network attached storage mounted or reachable from the application should look into it once the product is identified.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000648,"input_tokens":4485,"output_tokens":398,"severity_before":"high"},"analyst_status":"done","analyst_note":"Identify the affected product and its fixed versions from the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-12963.","search":"'-12963':18A,21A '-2026':17A,20A 'access':49B,85C 'account':5A,47B,81C 'allow':78C 'attach':9A,33B,52B,88C 'attack':60B 'axi':1A,25B,27B 'axis':22A 'axis-camera-st':26B 'camera':2A,23A,28B 'chang':68B 'could':65B,77C 'cve':16A,19A 'data':69B 'devic':11A,54B,73B,90C 'fix':12A 'flaw':40B 'gain':48B,83C 'host':37B 'infrastructur':30B 'let':41B 'login':64B 'low':44B 'low-privileg':43B 'network':8A,32B,51B,87C 'network-attached-storag':31B 'privileg':45B 'reach':7A 'reachabl':55B 'read':66B 'releas':15A 'self':36B 'self-host':35B 'server':58B,93C 'station':3A,24A,29B 'storag':10A,34B,53B,72B,89C 'unauthor':84C 'viewer':4A,46B,63B,80C 'vulner':75C 'window':38B 'yet':14A","nicknames":[],"mitigations":[],"who_affected":"Axis lists this CVE under AXIS Camera Station (the video management software). Teams running AXIS Camera Station with network storage reachable from the server, and with viewer-level accounts given to others, should look at it. Axis has not yet published affected versions or details, so the exact scope is unconfirmed. Teams that do not run AXIS Camera Station can skip it.","tier":"B","verified":{"fix":{"at":"2026-11-10T06:24:50Z","by":"analyst","doc":"https://help.axis.com/en-us/security-advisories","run_id":2417}},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["axiscamerastation","camerastation"],"ptokens":["axis","camera","station"],"labels":["axis","axiscamerastation","high","infrastructure","networkattachedstorage","selfhosted","windows"],"campaign_type":null,"search_a":"'-12963':18A,21A '-2026':17A,20A 'account':5A 'attach':9A 'axi':1A 'axis':22A 'camera':2A,23A 'cve':16A,19A 'devic':11A 'fix':12A 'network':8A 'reach':7A 'releas':15A 'station':3A,24A 'storag':10A 'viewer':4A 'yet':14A","search_b":"'access':49B 'account':47B 'attach':33B,52B 'attack':60B 'axi':25B,27B 'axis-camera-st':26B 'camera':28B 'chang':68B 'could':65B 'data':69B 'devic':54B,73B 'flaw':40B 'gain':48B 'host':37B 'infrastructur':30B 'let':41B 'login':64B 'low':44B 'low-privileg':43B 'network':32B,51B 'network-attached-storag':31B 'privileg':45B 'reachabl':55B 'read':66B 'self':36B 'self-host':35B 'server':58B 'station':29B 'storag':34B,53B,72B 'viewer':46B,63B 'window':38B","search_c":"'access':85C 'account':81C 'allow':78C 'attach':88C 'could':77C 'devic':90C 'gain':83C 'network':87C 'server':93C 'storag':89C 'unauthor':84C 'viewer':80C 'vulner':75C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T06:17:08+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L","cvss_by":"product-security@axis.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-12963","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-12963","severity":null,"published_at":"2026-11-10T06:17:08+00:00","modified_at":"2026-11-10T06:17:08+00:00","first_seen_at":"2026-11-10T06:20:23+00:00","fetched_at":"2026-11-10T06:20:23+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-12963:2417","url":"https://help.axis.com/en-us/security-advisories","severity":null,"published_at":"2026-11-10T06:24:50+00:00","modified_at":"2026-11-10T06:24:50+00:00","first_seen_at":"2026-11-10T06:24:50+00:00","fetched_at":"2026-11-10T06:24:50+00:00","note":"Axis registry (help.axis.com) lists CVE-2026-12963 7.4 High under AXIS Camera Station, released version TBA, details to follow on 10 Nov 2026; CVSS by Axis. No per-CVE advisory PDF found yet. Revisit when Axis publishes it. Whether the viewer account is a Camera Station role is inferred from the NVD summary, not confirmed.","cites":["https://help.axis.com/en-us/security-advisories"]}],"documents":[{"id":113491,"url":"https://help.axis.com/en-us/security-advisories","title":"Axis security advisories registry (Nov 2026)","kind":"vendor","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}