Description

The ACAP framework contains a Time-of-Check to Time-of-Use (TOCTOU) race condition, which could potentially lead to privilege escalation. This vulnerability can only be exploited if the Axis device is configured to allow the installation of unsigned ACAP applications, and if an attacker convinces the victim to install a malicious ACAP application.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.7",
  "pubDate": "2026-08-11T06:17:16.590Z",
  "pubdate": "2026-08-11T06:17:16.590Z",
  "executiveSummary": "The ACAP framework contains a Time-of-Check to Time-of-Use (TOCTOU) race condition vulnerability affecting Axis devices.\nThe primary impact of this vulnerability is potential privilege escalation, allowing an authenticated entity to execute operations with elevated privileges.\nThe affected system is the ACAP framework deployed on Axis devices configured to permit the installation of unsigned ACAP applications.\nThe risk implications include unauthorized system compromise and full administrative control over the underlying device if exploitation is successful.\nAn attacker must possess the capability to supply a specially crafted, malicious ACAP application and successfully execute social engineering tactics to convince a victim to install it.\nExploitation strictly requires specific pre-conditions: the target Axis device must explicitly allow the installation of unsigned ACAP applications, and user interaction in the form of installing the malicious package is mandatory.",
  "technicalDetails": "The root cause of the vulnerability resides in a Time-of-Check to Time-of-Use (TOCTOU) race condition within the application installation and validation logic of the ACAP framework.\nThe vulnerable component is the file validation and verification subsystem responsible for processing ACAP application packages during the installation phase.\nExploitation relies on manipulating state discrepancies between the initial security validation check of application files and their subsequent execution or installation use.\nThe attack flow begins when an attacker develops a malicious ACAP application engineered to exploit the window of vulnerability inherent in the TOCTOU race condition.\nThe attacker utilizes social engineering techniques to convince a victim to install the malicious ACAP application onto the target Axis device.\nDuring the installation process, the application triggers the TOCTOU condition by modifying critical file attributes or payload contents after the initial security check has completed but before the system consumes or installs the files.\nBecause the framework trusts the initial check and fails to re-validate the state of the files prior to use, the modified malicious code bypasses security controls.\nPrivilege requirements include user interaction to install the application, combined with an insecure device configuration that permits unsigned binaries.\nPost-exploitation impact includes unauthorized privilege escalation, enabling the malicious ACAP application to execute arbitrary commands or access restricted system resources with elevated privileges on the Axis device."
}