Description

The ACAP framework contains a Time-of-Check to Time-of-Use (TOCTOU) race condition, which could potentially lead to privilege escalation. This vulnerability can only be exploited if the Axis device is configured to allow the installation of unsigned ACAP applications, and if an attacker convinces the victim to install a malicious ACAP application.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.1",
  "pubDate": "2026-08-11T06:17:16.970Z",
  "pubdate": "2026-08-11T06:17:16.970Z",
  "executiveSummary": "The ACAP framework contains a Time-of-Check to Time-of-Use (TOCTOU) race condition vulnerability affecting Axis devices.\nThe primary impact of this vulnerability is potential privilege escalation, allowing an authenticated or socially engineered context to execute unauthorized privileged operations.\nThe affected system is the ACAP framework deployed on Axis devices.\nThe risk implications involve a compromise of device integrity and potential execution of arbitrary code with elevated privileges if the security boundary is successfully bypassed.\nAttacker capabilities require the ability to interact with the target device's installation mechanisms and deliver a malicious payload.\nExploitation requirements are conditional: the Axis device must be explicitly configured to allow the installation of unsigned ACAP applications, and an attacker must successfully convince a victim user to install the malicious ACAP application.",
  "technicalDetails": "The root cause of the vulnerability resides in a Time-of-Check to Time-of-Use (TOCTOU) race condition within the ACAP framework.\nThe vulnerable component is the application installation and validation subsystem responsible for parsing, verifying, and deploying ACAP applications on Axis devices.\nExploitation occurs when the application handler validates the state or contents of an ACAP package during an initial check phase, but a discrepancy or delay occurs before the package is actually utilized or installed in the use phase.\nDuring this asynchronous window, a concurrently executing malicious routine manipulates the target files or resources expected by the framework.\nBecause the validation check and the subsequent execution or installation actions are not properly synchronized or atomic, the system acts upon the altered, unverified, or malicious state.\nRegarding prerequisites and exposure, successful exploitation requires specific preconditions: the target Axis device must have its security configuration altered to permit the installation of unsigned ACAP applications, disabling default cryptographic verification safeguards.\nFurthermore, an attacker must leverage social engineering techniques to convince a victim to initiate the installation of the crafted malicious ACAP application.\nThe attack flow proceeds as follows: First, the attacker crafts a malicious ACAP application structured to exploit the synchronization gap. Second, the victim initiates the installation process on the vulnerable Axis device. Third, the ACAP framework performs its initial security checks on the package. Fourth, exploiting the race condition window, the payload swaps or modifies the validated contents prior to final processing. Fifth, the framework consumes the modified components with elevated privileges.\nThe post-exploitation impact includes unauthorized privilege escalation, allowing the malicious ACAP application to execute arbitrary operations beyond its intended restricted execution context, potentially compromising the underlying operating system and device security controls."
}