Axis Security Camera Flaws Enable Remote Takeover

Researchers who uncovered four severe flaws in Axis Communications’ video management and camera software say thousands of internet-connected surveillance systems are vulnerable to remote attacks that bypass authentication.

See Also: Frost Radar™ on Healthcare IoT Security in the United States

Attackers could potentially hijack entire security networks, crash camera systems or tap into live camera feeds, said Claroty researchers who uncovered the vulnerabilities that Axis Device Manager and Axis Camera Station, two core applications for managing IP-based security camera infrastructure. Exploiting flaws in the proprietary Axis. Remoting protocol, attackers can chain the vulnerabilities to gain unauthenticated, root-level remote code execution, effectively taking full control of entire surveillance networks.

Claroty’s Team82 found more than 6,500 Axis Camera Station servers exposed to the internet globally. The largest concentrations were found in the United States, Germany, Japan and the United Kingdom. This exposure increases the risk of exploitation by both financially motivated actors and advanced persistent threats seeking physical surveillance manipulation capabilities.

“Each of these servers could potentially manage hundreds or thousands of individual cameras,” Claroty said. “Given current bans on Chinese technology in many corners of the world, an organization’s choice of vendors has become somewhat limited, putting more emphasis on the protection of platforms available for these deployments.”

The most severe flaw, tracked as CVE-2024-3159, enables memory corruption in the Axis.Remoting service. An attacker can exploit this flaw to hijack the application flow and execute arbitrary code. The vulnerability carries a CVSS score of 9.8, which is a critical, highly exploitable flaw.

Another bug, CVE-2024-3160, enables unauthenticated users to call internal Axis.Remoting methods by bypassing authentication logic entirely. It stems from insufficient validation of function calls over TCP port 55752, the default port used by ADM’s service layer.

A third vulnerability, CVE-2024-3161, facilitates path traversal and arbitrary file write, which in combination with the earlier flaws, enables persistent exploitation and system compromise. It enables malicious actors to overwrite system files, including configuration and startup scripts on vulnerable devices.

The fourth issue is a denial-of-service vulnerability stemming from improper input handling within the Axis.Remoting message parser. Though it doesn’t lead to code execution, it can be used to crash services and disrupt video surveillance operations.

Axis Communications has patched all four vulnerabilities in recent versions of its software, ADM version 5.32 and above, ACS versions 5.58, 6.9.0 and above. The company recommends users upgrade immediately and restrict external network access to the Axis.Remoting TCP port if possible.

Technical analysis of the attack chain shows that it is possible to write a fully functional RCE payload that avoids detection by abusing the native Axis.Remoting serialization logic. Since the protocol uses MessagePack serialization, attackers can forge complex objects and invoke sensitive methods directly, bypassing standard access controls and integrity checks.

Additionally, because many surveillance setups are deployed in critical infrastructure such as airports, transit systems, government buildings and industrial sites, these vulnerabilities present not only cyber risk but potential physical safety risks. A successful attacker could disable or manipulate live camera feeds, erase recordings or pivot to other systems on the internal network.

While there is no evidence of exploitation in the wild so far, the high severity of the flaws, combined with the broad exposure, makes them attractive targets for reconnaissance, lateral movement or even supply chain compromise.

Security teams are urged to audit all Axis installations for affected versions, apply patches immediately, monitor for suspicious activity on TCP port 55752 and consider segmenting surveillance networks from general enterprise infrastructure to reduce attack surface.