How severe is CVE-2023-21405?

CVE-2023-21405 has a CVSS 3.x base score of 6.5, rated medium severity. It is exploitable over an adjacent network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is none, integrity none, and availability high.

Is CVE-2023-21405 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (21st percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2023-21405?

CVE-2023-21405 primarily affects Axis A1001 Firmware. In total, 5 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.

How do I fix CVE-2023-21405?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

When was CVE-2023-21405 published?

CVE-2023-21405 was published on 2023-07-25 and last updated on 2026-06-17.

CVE-2023-21405

CVE-2023-21405 is a medium-severity vulnerability in Axis A1001 Firmware with a CVSS 3.x base score of 6.5. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-1286.

Key facts

Severity: Medium (CVSS 3.x base score 6.5)
EPSS exploit prediction: 0% (21st percentile)
Actively exploited: Not listed in CISA KEV
Weakness: CWE-1286
Affected product: Axis A1001 Firmware
Published: 2023-07-25
Last modified: 2026-06-17

Description

Knud from Fraktal.fi has found a flaw in some Axis Network Door Controllers and Axis Network Intercoms when communicating over OSDP, highlighting that the OSDP message parser crashes the pacsiod process, causing a temporary unavailability of the door-controlling functionalities meaning that doors cannot be opened or closed. No sensitive or customer data can be extracted as the Axis device is not further compromised. Please refer to the Axis security advisory for more information, mitigation and affected products and software versions.

Frequently asked questions

What is CVE-2023-21405?: Knud from Fraktal.fi has found a flaw in some Axis Network Door Controllers and Axis Network Intercoms when communicating over OSDP, highlighting that the OSDP message parser crashes the pacsiod process, causing a temporary unavailability of the door-controlling functionalities meaning that doors cannot be opened or closed. No sensitive or customer data can be extracted as the Axis device is not further compromised. Please refer to the Axis security advisory for more information, mitigation and affected products and software versions.
How severe is CVE-2023-21405?: CVE-2023-21405 has a CVSS 3.x base score of 6.5, rated medium severity. It is exploitable over an adjacent network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is none, integrity none, and availability high.
Is CVE-2023-21405 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (21st percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2023-21405?: CVE-2023-21405 primarily affects Axis A1001 Firmware. In total, 5 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.
How do I fix CVE-2023-21405?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
When was CVE-2023-21405 published?: CVE-2023-21405 was published on 2023-07-25 and last updated on 2026-06-17.

References

https://www.axis.com/dam/public/7f/3a/ed/cve-2023-21405-en-US-407244.pdf

Affected products (5)

cpe:2.3:o:axis:a1001_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:axis:a1210_\(-b\)_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:axis:a1601_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:axis:a1610_\(-b\)_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:axis:axis_os:*:*:*:*:*:*:*:*

More vulnerabilities in Axis A1001 Firmware

CVE-2018-10662 — Critical (CVSS 9.8): An issue was discovered in multiple models of Axis IP Cameras. There is an Exposed Insecure Interface.
CVE-2018-10661 — Critical (CVSS 9.8): An issue was discovered in multiple models of Axis IP Cameras. There is a bypass of access control.
CVE-2018-10660 — Critical (CVSS 9.8): An issue was discovered in multiple models of Axis IP Cameras. There is Shell Command Injection.
CVE-2018-10664 — High (CVSS 7.5): An issue was discovered in the httpd process in multiple models of Axis IP Cameras. There is Memory Corruption.
CVE-2018-10663 — High (CVSS 7.5): An issue was discovered in multiple models of Axis IP Cameras. There is an Incorrect Size Calculation.
CVE-2018-10659 — High (CVSS 7.5): There was a Memory Corruption issue discovered in multiple models of Axis IP Cameras which allows remote attackers to…

All CVEs affecting Axis A1001 Firmware →

Other CWE-1286 vulnerabilities

CVE-2025-41719 — High (CVSS 8.8): A low privileged remote attacker can corrupt the webserver users storage on the device by setting a sequence of…
CVE-2026-6442 — High (CVSS 8.3): Improper validation of bash commands in Snowflake Cortex Code CLI versions prior to 1.0.25 allowed subsequent commands…
CVE-2024-26507 — High (CVSS 7.8): An issue in FinalWire AIRDA Extreme, AIDA64 Engineer, AIDA64 Business, AIDA64 Network Audit v.7.00.6700 and before…
CVE-2025-8873 — High (CVSS 7.5): On affected platforms running Arista EOS with IPsec configured, a specially crafted packet can cause the dataplane to…
CVE-2026-7307 — High (CVSS 7.5): A flaw was found in Keycloak. A remote, unauthenticated attacker can send a specially crafted XML input to the Security…
CVE-2026-40198 — High (CVSS 7.5): Net::CIDR::Lite versions before 0.23 for Perl does not validate IPv6 group count, which may allow IP ACL…

Browse all CWE-1286 vulnerabilities →