{"id":"CVE-2026-13312","kind":"vulnerability","aliases":["CVE-2026-13312"],"related":[],"title":"Axis Camera Station Pro and Camera Station 5: critical flaw (CVSS 9.9), details withheld by Axis","description":"A vulnerability that could allow an attacker to compromise a system.","summary":"Axis Communications says a bug-bounty researcher found a flaw in AXIS Camera Station Pro and AXIS Camera Station 5 that could let an attacker compromise a system (CWE-1287, improper validation of input type). Axis will not give more detail and says it knows of no public exploits or exploitation. The CVSS vector is network, low complexity, low privileges, no user interaction, scope changed.","severity":"critical","cvss":9.9,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"AXIS Camera Station Pro","fixed":["6.17"],"affected":">= 6.0, < 6.17","ecosystem":"vendor"},{"name":"AXIS Camera Station 5","fixed":["5.59 SR 2"],"affected":">= 5.0, < 5.59 SR 2","ecosystem":"vendor"}],"ecosystems":[],"tags":["axis","camera-station","other","self-hosted","video-surveillance"],"not_affected_if":[],"how_to_check":"Open AXIS Camera Station Pro and check the version: affected if below 6.17. For AXIS Camera Station 5, affected if below 5.59 SR 2.","fix":"Update AXIS Camera Station Pro to 6.17 or later; AXIS Camera Station 5 to 5.59 SR 2 or later.","status":"open","published_at":"2026-11-10T06:17:08+00:00","first_seen_at":"2026-11-10T06:20:23+00:00","triaged_at":"2026-11-10T06:22:12+00:00","updated_at":"2026-11-10T06:23:34+00:00","category":"other","confidence":0.8,"triage":{"at":"2026-11-10T06:22:12Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"Unnamed flaw lets an attacker compromise a system, CVSS 9.9","impact":"high","summary":"NVD rates CVE-2026-13312 critical with a CVSS score of 9.9, but the description only says an attacker could compromise a system. The affected product, the flawed component and the attack path are not stated in the sources.","audience":"businesses","category":"other","nicknames":[],"who_cares":[],"confidence":0.2,"fix_status":"unknown","needs_auth":"unknown","worst_case":"attacker compromises the system; exact impact not stated","analyst_note":"Identify the affected product and component from the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-13312 or the CNA advisory, then confirm versions, fix and exposure.","how_to_check":"unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":[],"who_is_affected":"unknown","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000643,"input_tokens":4457,"output_tokens":395,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Identify the affected product and component from the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-13312 or the CNA advisory, then confirm versions, fix and exposure.","search":"'-1287':72B '-13312':19A,22A '-2026':18A,21A '5':8A,30A,62B '9.9':12A 'allow':112C 'attack':67B,114C 'axi':1A,16A,31B,42B,54B,59B,78B 'axis':23A,27A 'bounti':48B 'bug':47B 'bug-bounti':46B 'camera':2A,6A,24A,28A,33B,55B,60B 'camera-st':32B 'chang':107B 'communic':43B 'complex':100B 'compromis':68B,116C 'could':64B,111C 'critic':9A 'cve':17A,20A 'cvss':11A,95B 'cwe':71B 'detail':13A,83B 'exploit':91B,93B 'flaw':10A,52B 'found':50B 'give':81B 'host':38B 'improp':73B 'input':76B 'interact':105B 'know':87B 'let':65B 'low':99B,101B 'network':98B 'privileg':102B 'pro':4A,26A,57B 'public':90B 'research':49B 'say':44B,85B 'scope':106B 'self':37B 'self-host':36B 'station':3A,7A,25A,29A,34B,56B,61B 'surveil':41B 'system':70B,118C 'type':77B 'user':104B 'valid':74B 'vector':96B 'video':40B 'video-surveil':39B 'vulner':109C 'withheld':14A","nicknames":[],"mitigations":[],"who_affected":"Teams running AXIS Camera Station Pro before 6.17 or AXIS Camera Station 5 before 5.59 SR 2 (video management servers for Axis cameras). The vector says an attacker needs network access and a low-privilege account. Anyone not running these products can skip it.","tier":"B","verified":{"fix":{"at":"2026-11-10T06:23:34Z","by":"analyst","doc":"https://www.axis.com/dam/public/e4/2d/85/cve-2026-13312pdf-en-US-561251.pdf","run_id":2412},"products":{"at":"2026-11-10T06:23:34Z","by":"analyst","doc":"https://www.axis.com/dam/public/e4/2d/85/cve-2026-13312pdf-en-US-561251.pdf","run_id":2412},"how_to_check":{"at":"2026-11-10T06:23:34Z","by":"analyst","doc":"https://www.axis.com/dam/public/e4/2d/85/cve-2026-13312pdf-en-US-561251.pdf","run_id":2412},"who_affected":{"at":"2026-11-10T06:23:34Z","by":"analyst","doc":"https://www.axis.com/dam/public/e4/2d/85/cve-2026-13312pdf-en-US-561251.pdf","run_id":2412}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["axiscamerastation5","axiscamerastationpro","camerastation5","camerastationpro"],"ptokens":["axis","camera","pro","station"],"labels":["axis","camerastation","critical","other","selfhosted","videosurveillance"],"campaign_type":null,"search_a":"'-13312':19A,22A '-2026':18A,21A '5':8A,30A '9.9':12A 'axi':1A,16A 'axis':23A,27A 'camera':2A,6A,24A,28A 'critic':9A 'cve':17A,20A 'cvss':11A 'detail':13A 'flaw':10A 'pro':4A,26A 'station':3A,7A,25A,29A 'withheld':14A","search_b":"'-1287':72B '5':62B 'attack':67B 'axi':31B,42B,54B,59B,78B 'bounti':48B 'bug':47B 'bug-bounti':46B 'camera':33B,55B,60B 'camera-st':32B 'chang':107B 'communic':43B 'complex':100B 'compromis':68B 'could':64B 'cvss':95B 'cwe':71B 'detail':83B 'exploit':91B,93B 'flaw':52B 'found':50B 'give':81B 'host':38B 'improp':73B 'input':76B 'interact':105B 'know':87B 'let':65B 'low':99B,101B 'network':98B 'privileg':102B 'pro':57B 'public':90B 'research':49B 'say':44B,85B 'scope':106B 'self':37B 'self-host':36B 'station':34B,56B,61B 'surveil':41B 'system':70B 'type':77B 'user':104B 'valid':74B 'vector':96B 'video':40B 'video-surveil':39B","search_c":"'allow':112C 'attack':114C 'compromis':116C 'could':111C 'system':118C 'vulner':109C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T06:17:08+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","cvss_by":"product-security@axis.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-13312","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-13312","severity":null,"published_at":"2026-11-10T06:17:08+00:00","modified_at":"2026-11-10T06:17:08+00:00","first_seen_at":"2026-11-10T06:20:23+00:00","fetched_at":"2026-11-10T06:20:23+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-13312:2412","url":"https://www.axis.com/dam/public/e4/2d/85/cve-2026-13312pdf-en-US-561251.pdf","severity":null,"published_at":"2026-11-10T06:23:34+00:00","modified_at":"2026-11-10T06:23:34+00:00","first_seen_at":"2026-11-10T06:23:34+00:00","fetched_at":"2026-11-10T06:23:34+00:00","note":"Axis advisory (primary) read: Camera Station Pro <6.17 and Camera Station 5 <5.59 SR2; Axis withholds details, no known exploit. Vector AV:N/PR:L (low-priv auth, network).","cites":["https://www.axis.com/dam/public/e4/2d/85/cve-2026-13312pdf-en-US-561251.pdf"]}],"documents":[{"id":113489,"url":"https://www.axis.com/dam/public/e4/2d/85/cve-2026-13312pdf-en-US-561251.pdf","title":"Axis Security Advisory CVE-2026-13312","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}