CVE-2026-5303
MediumCVSS 5.7Exploitation Probability (EPSS)
Low risk6th percentile - higher than 6% of all known CVEs
Summary
The ACAP framework contains a Time-of-Check to Time-of-Use (TOCTOU) race condition, which could potentially lead to privilege escalation. This vulnerability can only be exploited if the Axis device is configured to allow installation of unsigned ACAP applications and if an attacker convinces the victim to install a malicious ACAP application.
Risk Assessment
Privilege escalation could allow an attacker to gain higher privileges on the device, potentially leading to full system compromise.
Recommendation
Update the ACAP framework to a patched version and consider disabling installation of unsigned ACAP applications on Axis devices.
Original NVD description (English source)
The ACAP framework contains a Time-of-Check to Time-of-Use (TOCTOU) race condition, which could potentially lead to privilege escalation. This vulnerability can only be exploited if the Axis device is configured to allow the installation of unsigned ACAP applications, and if an attacker convinces the victim to install a malicious ACAP application.