CVE-2022-23410

HIGH

Axis IP Utility < 4.18.0 - Uncontrolled Search Path

Title source: rule

Description

AXIS IP Utility before 4.18.0 allows for remote code execution and local privilege escalation by the means of DLL hijacking. IPUtility.exe would attempt to load DLLs from its current working directory which could allow for remote code execution if a compromised DLL would be placed in the same folder.

Scores

CVSS v3 7.8
EPSS 0.0072
EPSS Percentile 72.2%
Attack Vector LOCAL
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Classification

CWE
CWE-427
Status published

Affected Products (1)

axis/ip_utility < 4.18.0

Timeline

Published Feb 14, 2022
Tracked Since Feb 18, 2026