CVE-2026-63282
Received Received - Intake

Improper Shell Quote Escaping in AXIS Device Firmware Leading to Command Injection

Publication date: 2026-11-10

Last updated on: 2026-11-10

Assigner: Axis Communications AB

Description
Improper shell quote escaping when processing user-controlled input, potentially allowing command injection, which could lead to privilege escalation.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-10
Last Modified
2026-11-10
Generated
2026-11-10
AI Q&A
2026-11-10
EPSS Evaluated
N/A
NVD
CVE-2026-63282
EUVD
EUVD-2026-120773

Affected Vendors & Products

Showing 7 associated CPEs
Vendor Product Version / Range
Axis Communications AB AXIS OS From 13.0.0 (inc) to 13.0.84 (exc)
Axis Communications AB AXIS OS From 12.0.0 (inc) to 12.11.123 (exc)
Axis Communications AB AXIS OS From 11.0.0 (inc) to 11.11.231 (exc)
Axis Communications AB AXIS OS From 10.0.0 (inc) to 10.12.354 (exc)
Axis Communications AB AXIS OS From 9.0.0 (inc) to 9.80.153 (exc)
Axis Communications AB AXIS OS From 7.0.0 (inc) to 8.40.112 (exc)
Axis Communications AB AXIS OS From 6.0.0 (inc) to 6.50.5.23 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-1287 The product receives input that is expected to be of a certain type, but it does not validate or incorrectly validates that the input is actually of the expected type.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability involves improper shell quote escaping when processing user-controlled input in AXIS OS. This flaw could allow command injection, potentially leading to privilege escalation. Exploitation requires authentication with an admin-privileged service account.

Detection Guidance

To detect this vulnerability, check if your AXIS OS version is listed as affected and not patched. Review system logs for suspicious command injection attempts or privilege escalation activities. Use network scanning tools to identify devices running vulnerable AXIS OS versions.

Impact Analysis

An attacker with admin privileges could exploit this to execute arbitrary commands on the system, potentially gaining higher privileges or controlling the device. This could lead to unauthorized access or system compromise.

Compliance Impact

The vulnerability could allow command injection and privilege escalation if exploited, which may lead to unauthorized access to sensitive data. This could impact compliance with GDPR (data protection) and HIPAA (healthcare data security) by potentially exposing personal or protected health information.

Mitigation Strategies

Immediately update your AXIS OS to the latest patched version provided by Axis. Ensure admin-privileged accounts are secured with strong passwords and multi-factor authentication. Monitor for any unauthorized access or unusual activity.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-63282. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...