AXIS CAMERA STATION PRO · CVE-2026-13312 · Other
FIX → 6.17 · 5.59 SR 2 ✓ verified
Axis Communications says a bug-bounty researcher found a flaw in AXIS Camera Station Pro and AXIS Camera Station 5 that could let an attacker compromise a system (CWE-1287, improper validation of input type). Axis will not give more detail and says it knows of no public exploits or exploitation. The CVSS vector is network, low complexity, low privileges, no user interaction, scope changed.
first public Nov 10, 2026 · 2 sources
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Teams running AXIS Camera Station Pro before 6.17 or AXIS Camera Station 5 before 5.59 SR 2 (video management servers for Axis cameras). The vector says an attacker needs network access and a low-privilege account. Anyone not running these products can skip it.
Who cares axis, camera-station, self-hosted, video-surveillance
Upgrade to 6.17 · 5.59 SR 2
A vulnerability that could allow an attacker to compromise a system.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
Update AXIS Camera Station Pro to 6.17 or later; AXIS Camera Station 5 to 5.59 SR 2 or later.