{"id":"CVE-2026-8372","kind":"vulnerability","aliases":["CVE-2026-8372"],"related":[],"title":"AXIS Camera Station Pro 6.13–6.17: missing authentication allows unauthorized access","description":"A vulnerability that could allow an attacker to gain unauthorized access.","summary":"Axis reports a missing-authentication flaw (CWE-306, CVSS 8.8) in AXIS Camera Station Pro 6.13 to 6.17, found via its bug bounty. Axis gives no technical detail, says no public exploits exist and it is not aware of exploitation. Fixed in 6.18.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"AXIS Camera Station Pro","fixed":["6.18"],"affected":">= 6.13, < 6.18","ecosystem":"vendor"}],"ecosystems":[],"tags":["axis","axis-camera-station-pro","other","self-hosted","video-surveillance"],"not_affected_if":[],"how_to_check":"Check the installed AXIS Camera Station Pro version. 6.13 through 6.17 are affected; 6.18 contains the fix.","fix":"Update AXIS Camera Station Pro to 6.18 or later.","status":"open","published_at":"2026-11-10T06:17:10+00:00","first_seen_at":"2026-11-10T06:20:23+00:00","triaged_at":"2026-11-10T06:22:12+00:00","updated_at":"2026-11-10T06:23:33+00:00","category":"other","confidence":0.85,"triage":{"at":"2026-11-10T06:22:12Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"Unidentified flaw lets an attacker gain unauthorized access","impact":"high","summary":"The sources describe a flaw that could let an attacker gain unauthorized access, with a CVSS score of 8.8. They do not name the affected product, the vulnerable code, or how the access is gained.","audience":"businesses","category":"other","nicknames":[],"who_cares":[],"confidence":0.3,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Attacker gains unauthorized access to the affected system","analyst_note":"Identify the affected product and versions from the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-8372 and find the vendor advisory.","how_to_check":"unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":[],"who_is_affected":"unknown","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000631,"input_tokens":4462,"output_tokens":370,"severity_before":"high"},"analyst_status":"done","analyst_note":"Identify the affected product and versions from the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-8372 and find the vendor advisory.","search":"'-2026':13A,16A '-306':43B '-8372':14A,17A '6.13':5A,51B '6.17':6A,53B '6.18':78B '8.8':45B 'access':11A,89C 'allow':9A,83C 'attack':85C 'authent':8A,40B 'awar':73B 'axi':1A,22B,24B,35B,47B,59B 'axis':18A 'axis-camera-station-pro':23B 'bounti':58B 'bug':57B 'camera':2A,19A,25B,48B 'could':82C 'cve':12A,15A 'cvss':44B 'cwe':42B 'detail':63B 'exist':68B 'exploit':67B,75B 'fix':76B 'flaw':41B 'found':54B 'gain':87C 'give':60B 'host':31B 'miss':7A,39B 'missing-authent':38B 'pro':4A,21A,27B,50B 'public':66B 'report':36B 'say':64B 'self':30B 'self-host':29B 'station':3A,20A,26B,49B 'surveil':34B 'technic':62B 'unauthor':10A,88C 'via':55B 'video':33B 'video-surveil':32B 'vulner':80C","nicknames":[],"mitigations":[],"who_affected":"Teams running AXIS Camera Station Pro (video management software) 6.13 to 6.17. Axis does not say how the flaw is reached, so treat any exposed install as at risk. Versions before 6.13 and 6.18 or later are not listed as affected.","tier":"B","verified":{"fix":{"at":"2026-11-10T06:23:33Z","by":"analyst","doc":"https://www.axis.com/dam/public/09/58/fa/cve-2026-8372pdf-en-US-561247.pdf","run_id":2413},"products":{"at":"2026-11-10T06:23:33Z","by":"analyst","doc":"https://www.axis.com/dam/public/09/58/fa/cve-2026-8372pdf-en-US-561247.pdf","run_id":2413},"how_to_check":{"at":"2026-11-10T06:23:33Z","by":"analyst","doc":"https://www.axis.com/dam/public/09/58/fa/cve-2026-8372pdf-en-US-561247.pdf","run_id":2413},"who_affected":{"at":"2026-11-10T06:23:33Z","by":"analyst","doc":"https://www.axis.com/dam/public/09/58/fa/cve-2026-8372pdf-en-US-561247.pdf","run_id":2413}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["axiscamerastationpro","camerastationpro"],"ptokens":["axis","camera","pro","station"],"labels":["axis","axiscamerastationpro","high","other","selfhosted","videosurveillance"],"campaign_type":null,"search_a":"'-2026':13A,16A '-8372':14A,17A '6.13':5A '6.17':6A 'access':11A 'allow':9A 'authent':8A 'axi':1A 'axis':18A 'camera':2A,19A 'cve':12A,15A 'miss':7A 'pro':4A,21A 'station':3A,20A 'unauthor':10A","search_b":"'-306':43B '6.13':51B '6.17':53B '6.18':78B '8.8':45B 'authent':40B 'awar':73B 'axi':22B,24B,35B,47B,59B 'axis-camera-station-pro':23B 'bounti':58B 'bug':57B 'camera':25B,48B 'cvss':44B 'cwe':42B 'detail':63B 'exist':68B 'exploit':67B,75B 'fix':76B 'flaw':41B 'found':54B 'give':60B 'host':31B 'miss':39B 'missing-authent':38B 'pro':27B,50B 'public':66B 'report':36B 'say':64B 'self':30B 'self-host':29B 'station':26B,49B 'surveil':34B 'technic':62B 'via':55B 'video':33B 'video-surveil':32B","search_c":"'access':89C 'allow':83C 'attack':85C 'could':82C 'gain':87C 'unauthor':88C 'vulner':80C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T06:17:10+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cvss_by":"product-security@axis.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-8372","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-8372","severity":null,"published_at":"2026-11-10T06:17:10+00:00","modified_at":"2026-11-10T06:17:10+00:00","first_seen_at":"2026-11-10T06:20:23+00:00","fetched_at":"2026-11-10T06:20:23+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-8372:2413","url":"https://www.axis.com/dam/public/09/58/fa/cve-2026-8372pdf-en-US-561247.pdf","severity":null,"published_at":"2026-11-10T06:23:33+00:00","modified_at":"2026-11-10T06:23:33+00:00","first_seen_at":"2026-11-10T06:23:33+00:00","fetched_at":"2026-11-10T06:23:33+00:00","note":"Axis advisory (primary) read: CWE-306, ACS Pro 6.13-6.17, fixed 6.18, no known exploits per Axis. Axis withholds details; no mitigations or workarounds stated.","cites":["https://www.axis.com/dam/public/09/58/fa/cve-2026-8372pdf-en-US-561247.pdf"]}],"documents":[{"id":113490,"url":"https://www.axis.com/dam/public/09/58/fa/cve-2026-8372pdf-en-US-561247.pdf","title":"Axis Security Advisory CVE-2026-8372","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}