{"id":"CVE-2026-12963","aliases":[],"cve":{"records":[{"id":"CVE-2026-12963","source":"Axis","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-06-23T08:24:54.236Z","published":"2026-11-10T05:42:16.465Z","modified":"2026-11-12T17:41:51.130Z"}],"publishers":[{"name":"Axis","role":"CNA","organizationId":"f2daf9a0-02c2-4b83-a01d-63b3b304b807","modified":"2026-11-10T05:42:16.465Z"},{"name":"CISA-ADP","role":"ADP","organizationId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","modified":"2026-11-12T17:41:51.130Z"}],"references":[{"url":"https://www.axis.com/dam/public/c5/ba/15/cve-2026-12963pdf-en-US-561249.pdf","tags":[],"source":"Axis"}],"weaknesses":[{"id":"CWE-732","description":"CWE-732: Incorrect Permission Assignment for Critical Resource","source":"Axis"}],"applicability":[],"prioritization":[{"source":"CISA-ADP","type":"SSVC","role":"CISA Coordinator","timestamp":"2026-11-12T17:41:39.596200Z","decisions":[{"name":"Exploitation","value":"none"},{"name":"Automatable","value":"no"},{"name":"Technical Impact","value":"partial"}]}]},"title":"A vulnerability that could allow a viewer account to gain unauthorized access to network attached storage devices on the server.","titleSource":"Axis","descriptionSource":"Axis","description":"A vulnerability that could allow a viewer account to gain unauthorized access to network attached storage devices on the server.","score":7.4,"severity":"high","published":"2026-11-10T05:42:16.465Z","modified":"2026-11-12T17:41:51.130Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"Axis Communications AB","name":"AXIS Camera Station Pro","platforms":[],"versions":[{"version":"6.0","status":"affected","lessThan":"6.18","versionType":"maven"}],"defaultStatus":"unaffected","cpes":[],"source":"Axis","url":"https://www.cve.org/CVERecord?id=CVE-2026-12963"},{"vendor":"Axis Communications AB","name":"AXIS Camera Station 5","platforms":[],"versions":[{"version":"5.0","status":"affected","lessThan":"5.59","versionType":"maven"}],"defaultStatus":"unaffected","cpes":[],"source":"Axis","url":"https://www.cve.org/CVERecord?id=CVE-2026-12963"}],"remediation":[],"references":["https://www.axis.com/dam/public/c5/ba/15/cve-2026-12963pdf-en-US-561249.pdf"],"sources":[{"name":"CVE","id":"CVE-2026-12963","modified":"2026-11-12T17:41:51.130Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-12963"}],"assessments":[{"source":"Axis","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L","score":7.4}],"sourceAffected":[],"observedAt":"2026-11-12T19:06:28.485Z","kev":{"status":"not-listed","checkedAt":"2026-11-14T22:15:32.260Z"},"coverage":[{"source":"NVD","status":"no-result","checkedAt":"2026-11-10T05:55:32.235Z","attemptedAt":"2026-11-10T05:55:32.235Z"},{"source":"GHSA","status":"no-result","checkedAt":"2026-11-10T05:55:32.298Z","attemptedAt":"2026-11-10T05:55:32.298Z"},{"source":"EUVD","status":"no-result","checkedAt":"2026-11-10T05:55:32.230Z","attemptedAt":"2026-11-10T05:55:32.230Z"},{"source":"EPSS","status":"no-result","checkedAt":"2026-11-10T05:55:32.202Z","attemptedAt":"2026-11-10T05:55:32.202Z"}],"evidence":[],"aiSummary":{"text":"A vulnerability in Axis Communications AB's AXIS Camera Station Pro (versions 6.0 to 6.18) and AXIS Camera Station 5 (versions 5.0 to 5.59) could allow a viewer account to gain unauthorized access to network attached storage devices on the server. The weakness is due to incorrect permission assignment for a critical resource. Viewer account access is required to exploit the vulnerability.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-11-10T05:51:03.707Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2026-12963"}]}}