{"id":"CVE-2026-63287","aliases":[],"cve":{"records":[{"id":"CVE-2026-63287","source":"Axis","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-07-16T08:28:41.293Z","published":"2026-11-10T05:50:57.601Z","modified":"2026-11-12T17:41:40.637Z"}],"publishers":[{"name":"Axis","role":"CNA","organizationId":"f2daf9a0-02c2-4b83-a01d-63b3b304b807","modified":"2026-11-10T05:50:57.601Z"},{"name":"CISA-ADP","role":"ADP","organizationId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","modified":"2026-11-12T17:41:40.637Z"}],"references":[{"url":"https://www.axis.com/dam/public/bc/65/61/cve-2026-63287pdf-en-US-561253.pdf","tags":[],"source":"Axis"}],"weaknesses":[{"id":"CWE-117","description":"CWE-117: Improper Output Neutralization for Logs","source":"Axis"},{"id":"CWE-863","description":"CWE-863: Incorrect Authorization","source":"Axis"}],"applicability":[],"prioritization":[{"source":"CISA-ADP","type":"SSVC","role":"CISA Coordinator","timestamp":"2026-11-12T17:41:25.707499Z","decisions":[{"name":"Exploitation","value":"none"},{"name":"Automatable","value":"no"},{"name":"Technical Impact","value":"partial"}]}]},"title":"It was possible for an authenticated non-admin user to modify certain data objects without having the appropriate permissions, which could be used to tamper…","titleSource":"Axis","descriptionSource":"Axis","description":"It was possible for an authenticated non-admin user to modify certain data objects without having the appropriate permissions, which could be used to tamper with audit log creation in AXIS Camera Station.","score":6.5,"severity":"medium","published":"2026-11-10T05:50:57.601Z","modified":"2026-11-12T17:41:40.637Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"Axis Communications AB","name":"AXIS Camera Station Pro","platforms":[],"versions":[{"version":"6.0","status":"affected","lessThan":"6.18","versionType":"maven"}],"defaultStatus":"unaffected","cpes":[],"source":"Axis","url":"https://www.cve.org/CVERecord?id=CVE-2026-63287"},{"vendor":"Axis Communications AB","name":"AXIS Camera Station 5","platforms":[],"versions":[{"version":"5.0","status":"affected","lessThan":"5.59","versionType":"maven"}],"defaultStatus":"unaffected","cpes":[],"source":"Axis","url":"https://www.cve.org/CVERecord?id=CVE-2026-63287"}],"remediation":[],"references":["https://www.axis.com/dam/public/bc/65/61/cve-2026-63287pdf-en-US-561253.pdf"],"sources":[{"name":"CVE","id":"CVE-2026-63287","modified":"2026-11-12T17:41:40.637Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-63287"}],"assessments":[{"source":"Axis","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","score":6.5}],"sourceAffected":[],"observedAt":"2026-11-12T19:06:38.685Z","kev":{"status":"not-listed","checkedAt":"2026-11-15T01:55:30.737Z"},"coverage":[{"source":"NVD","status":"no-result","checkedAt":"2026-11-10T06:05:34.336Z","attemptedAt":"2026-11-10T06:05:34.336Z"},{"source":"GHSA","status":"no-result","checkedAt":"2026-11-10T06:05:33.614Z","attemptedAt":"2026-11-10T06:05:33.614Z"},{"source":"EUVD","status":"no-result","checkedAt":"2026-11-10T06:05:33.880Z","attemptedAt":"2026-11-10T06:05:33.880Z"},{"source":"EPSS","status":"no-result","checkedAt":"2026-11-10T06:05:33.563Z","attemptedAt":"2026-11-10T06:05:33.563Z"}],"evidence":[],"aiSummary":{"text":"AXIS Camera Station Pro versions before 6.18 and AXIS Camera Station 5 versions before 5.59 allow authenticated non-admin users to modify certain data objects without proper permissions, potentially tampering with audit log creation. The required attacker access is authentication. The weakness is incorrect authorization.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-11-10T06:01:07.608Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2026-63287"}]}}