CVE-2015-8255

HIGH

AXIS Communications Firmware - Cross-Site Request Forgery via admin/pwdgrp.cgi vaconfig.cgi and admin/local_del.cgi

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2015-8255. PoCs published by Orwelllabs.

AI-analyzed exploit summary This exploit demonstrates a Cross-Site Request Forgery (CSRF) vulnerability in AXIS Communications devices, allowing an attacker to change the root password, add new credentials, or delete applications via crafted HTML forms.

Description

AXIS Communications products allow CSRF, as demonstrated by admin/pwdgrp.cgi, vaconfig.cgi, and admin/local_del.cgi.

Exploits (1)

exploitdb WORKING POC
by Orwelllabs · textwebappshardware
https://www.exploit-db.com/exploits/41626

This exploit demonstrates a Cross-Site Request Forgery (CSRF) vulnerability in AXIS Communications devices, allowing an attacker to change the root password, add new credentials, or delete applications via crafted HTML forms.

Classification
Working Poc 100%
Attack Type
Auth Bypass
Complexity
Trivial
Reliability
Reliable
Target: AXIS Communications IoT devices (web interface)
No auth needed
Prerequisites: Victim must visit a malicious webpage while authenticated to the target device
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (1)

Core 1
Core References
Exploit, Third Party Advisory, VDB Entry exploit x_refsource_exploit-db
https://www.exploit-db.com/exploits/41626/

Scores

CVSS v3 8.8
EPSS 0.0217
EPSS Percentile 79.9%
Attack Vector NETWORK
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Details

CWE
CWE-352
Status published
Products (2)
axis/axis_communications_firmware
n/a/AXIS Communications products AXIS Communications products
Published Apr 10, 2017
Tracked Since Feb 18, 2026