CVE-2026-13409 PUBLISHED

Assigner: Axis
Reserved: 26.06.2026 Published: 10.11.2026 Updated: 10.11.2026

The VAPIX API dynamicoverlay.cgi which results in a Denial-of-Service of the overlay functionality. This flaw can only be exploited after authenticating with an operator or admin-privileged service account.

Metrics

CVSS 3.1

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
CVSS Score: 4.3

Attack Vector	Network	Scope	Unchanged
Attack Complexity	Low	Confidentiality Impact	None
Privileges Required	Low	Integrity Impact	None
User Interaction	None	Availability Impact	Low

CVSS 3.1

Product Status

Vendor	Axis Communications AB
Product	AXIS OS
Versions	Default: unaffected affected from 13.0.0 to 13.0.31 (excl.) affected from 12.0.0 to 12.11.84 (excl.) affected from 11.0.0 to 11.11.218 (excl.) affected from 10.0.0 to 10.12.345 (excl.) affected from 9.0.0 to 9.80.148 (excl.)

Credits

Jincheng Wang finder

References

https://www.axis.com/dam/public/ef/b3/81/cve-2026-13409pdf-en-US-561255.pdf

Problem Types

CWE-121: Stack-based Buffer Overflow CWE