{"id":"CVE-2026-13409","kind":"vulnerability","aliases":["CVE-2026-13409"],"related":[],"title":"Axis VAPIX dynamicoverlay.cgi flaw lets operators crash camera overlay feature","description":"The VAPIX API dynamicoverlay.cgi which results in a Denial-of-Service of the overlay functionality. This flaw can only be exploited after authenticating with an operator or admin-privileged service account.","summary":"The VAPIX API endpoint dynamicoverlay.cgi can be abused to cause a denial of service in the camera's overlay functionality. Exploitation requires an authenticated operator or admin-privileged service account.","severity":"medium","cvss":4.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["axis","infrastructure","network-cameras","vapix"],"not_affected_if":["auth-required"],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-10T06:17:08+00:00","first_seen_at":"2026-11-10T06:20:23+00:00","triaged_at":"2026-11-10T06:22:21+00:00","updated_at":"2026-11-10T06:22:21+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-11-10T06:22:21Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Axis VAPIX dynamicoverlay.cgi flaw lets operators crash camera overlay feature","impact":"low","summary":"The VAPIX API endpoint dynamicoverlay.cgi can be abused to cause a denial of service in the camera's overlay functionality. Exploitation requires an authenticated operator or admin-privileged service account.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["axis","vapix","network-cameras"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"Overlay functionality on the device becomes unavailable until restarted","analyst_note":"Check the vendor advisory for affected Axis firmware versions and fixed releases; NVD entry alone does not name products or fixes.","how_to_check":"- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["auth-required"],"who_is_affected":"Teams running Axis network cameras or devices that expose the VAPIX API with dynamic overlay features. Exposure depends on whether untrusted or low-privilege accounts hold operator or admin service credentials; the sources do not list affected firmware versions.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000684,"input_tokens":4524,"output_tokens":464,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-13409':13A,16A '-2026':12A,15A 'abus':30B 'account':53B,86C 'admin':50B,83C 'admin-privileg':49B,82C 'api':25B,56C 'authent':46B,77C 'axi':1A,17B 'camera':8A,21B,39B 'caus':32B 'crash':7A 'cve':11A,14A 'denial':34B,63C 'denial-of-servic':62C 'dynamicoverlay.cgi':3A,27B,57C 'endpoint':26B 'exploit':43B,75C 'featur':10A 'flaw':4A,71C 'function':42B,69C 'infrastructur':18B 'let':5A 'network':20B 'network-camera':19B 'oper':6A,47B,80C 'overlay':9A,41B,68C 'privileg':51B,84C 'requir':44B 'result':59C 'servic':36B,52B,65C,85C 'vapix':2A,22B,24B,55C","nicknames":[],"mitigations":[],"who_affected":"Teams running Axis network cameras or devices that expose the VAPIX API with dynamic overlay features. Exposure depends on whether untrusted or low-privilege accounts hold operator or admin service credentials; the sources do not list affected firmware versions.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["axis","infrastructure","medium","networkcameras","vapix"],"campaign_type":null,"search_a":"'-13409':13A,16A '-2026':12A,15A 'axi':1A 'camera':8A 'crash':7A 'cve':11A,14A 'dynamicoverlay.cgi':3A 'featur':10A 'flaw':4A 'let':5A 'oper':6A 'overlay':9A 'vapix':2A","search_b":"'abus':30B 'account':53B 'admin':50B 'admin-privileg':49B 'api':25B 'authent':46B 'axi':17B 'camera':21B,39B 'caus':32B 'denial':34B 'dynamicoverlay.cgi':27B 'endpoint':26B 'exploit':43B 'function':42B 'infrastructur':18B 'network':20B 'network-camera':19B 'oper':47B 'overlay':41B 'privileg':51B 'requir':44B 'servic':36B,52B 'vapix':22B,24B","search_c":"'account':86C 'admin':83C 'admin-privileg':82C 'api':56C 'authent':77C 'denial':63C 'denial-of-servic':62C 'dynamicoverlay.cgi':57C 'exploit':75C 'flaw':71C 'function':69C 'oper':80C 'overlay':68C 'privileg':84C 'result':59C 'servic':65C,85C 'vapix':55C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T06:17:08+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","cvss_by":"product-security@axis.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-13409","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-13409","severity":null,"published_at":"2026-11-10T06:17:08+00:00","modified_at":"2026-11-10T06:17:08+00:00","first_seen_at":"2026-11-10T06:20:23+00:00","fetched_at":"2026-11-10T06:20:23+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}