This vulnerability arises from improper validation of input types in an ACAP configuration file on AXIS OS 12.0.0. If the device permits installation of unsigned ACAP applications, an attacker who convinces a user to install a malicious ACAP app could execute commands leading to privilege escalation. The CVSS 3.1 base score is 6.0, reflecting a medium severity with local attack vector, low attack complexity, high privileges required, no user interaction, unchanged scope, and high impact on confidentiality and integrity but no impact on availability. No patch or official remediation guidance is currently available from Axis Communications.

Successful exploitation could allow an attacker to execute arbitrary commands on the device and escalate privileges, potentially compromising confidentiality and integrity of the system. However, exploitation requires local access with high privileges and user installation of a malicious unsigned ACAP application, limiting the attack surface. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, it is recommended to disable the installation of unsigned ACAP applications to prevent exploitation. Users should avoid installing ACAP applications from untrusted sources.