PatchTheCVECVE-2024-6979: Amin Aliakbari, member of the AXIS OS Bug Bounty Program, has found a broken access control which would lead t
CVE-2024-6979 is a medium-severity flaw (CVSS 6.8) affecting axis os 2024. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
Amin Aliakbari, member of the AXIS OS Bug Bounty Program, has found a broken access control which would lead to less-privileged operator- and/or viewer accounts having more privileges than designed. The risk of exploitation is very low as it requires complex steps to execute, including knowing of account passwords and social engineering attacks in tricking the administrator to perform specific configurations on operator- and/or viewer-privileged
Why this priority
- No elevated risk signals yet
A fixed release or distro patch exists.
Risk facts
| CVSS score | 6.8 (Medium) |
| Attack vector | Network (remote) |
| Attack complexity | Low |
| Privileges needed | High |
| User interaction | Required |
| EPSS exploit chance | 0.3% (top 77%) |
| CISA exploited list | No |
| Weakness | CWE-863 |
| Published | 2024-09-10 |
| Last modified | 2026-06-17 |
Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2024-6979?
axis os 2024: upgrade to 11.11.94. Exact commands for each OS are on this page.
Is CVE-2024-6979 being exploited?
CVE-2024-6979 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2024-6979 affect?
CVE-2024-6979 affects axis os 2024. Severity is medium (CVSS 6.8). Amin Aliakbari, member of the AXIS OS Bug Bounty Program, has found a broken access control which would lead to less-privileged operator- and/or viewer accounts having more privileges than designed. The risk of exploitation is very low as i
How urgent is CVE-2024-6979?
Priority 30/100. No elevated risk signals yet.
Related CVEs
- CVE-2025-0361 MEDIUM 4.3 UPGRADE UPGRADE During an annual penetration test conducted on behalf of Axis Communications, Truesec discovered a flaw in the
- CVE-2025-0360 HIGH 7.8 UPGRADE UPGRADE During an annual penetration test conducted on behalf of Axis Communication, Truesec discovered a flaw in the
- CVE-2025-0359 HIGH 8.5 UPGRADE UPGRADE During an annual penetration test conducted on behalf of Axis Communication, Truesec discovered a flaw in the
- CVE-2025-0324 CRITICAL 9.4 UPGRADE UPGRADE The VAPIX Device Configuration framework allowed a privilege escalation, enabling a lower-privileged user to g
- CVE-2024-8160 LOW 3.8 UPGRADE UPGRADE Erik de Jong, member of the AXIS OS Bug Bounty Program, has found that the VAPIX API ftptest.cgi did not have