CVE-2023-21405 : What You Need to Know

This CVE-2023-21405 article provides insights into a Denial-of-Service vulnerability in Axis Network Door Controller's and Axis Network Intercom's OSDP communication.

Understanding CVE-2023-21405

The vulnerability in question was discovered by Knud from Fraktal.fi, who found a flaw in some Axis Network Door Controllers and Axis Network Intercoms during communication over OSDP. This flaw causes the OSDP message parser to crash the pacsiod process, resulting in a temporary unavailability of door-controlling functionalities. Although this vulnerability causes doors to be unable to open or close temporarily, no sensitive or customer data can be extracted as the Axis device is not further compromised.

What is CVE-2023-21405?

CVE-2023-21405 is a Denial-of-Service vulnerability that affects Axis Network Door Controller's and Axis Network Intercom's OSDP communication, leading to a temporary disruption in the door-controlling functionalities.

The Impact of CVE-2023-21405

The impact of CVE-2023-21405 revolves around the temporary unavailability of door-controlling functionalities due to the OSDP message parser crashing the pacsiod process. While this vulnerability disrupts the normal operation of the affected devices, it does not result in the extraction of sensitive or customer data.

Technical Details of CVE-2023-21405

The vulnerability has a CVSSv3.1 base score of 6.5, categorizing it as having a medium severity level. The attack complexity is considered low, with an adjacent network attack vector and a high availability impact. The exploit does not require privileges, user interaction, or impact confidentiality and integrity. The affected products include various Axis Network Door Controllers and Network Intercoms with specific versions prone to this vulnerability.

Vulnerability Description

The vulnerability allows attackers to disrupt the door-controlling functionalities by crashing the OSDP message parser, causing a Denial-of-Service situation for the affected Axis devices.

Affected Systems and Versions

Several Axis products are affected, including AXIS A1001 Network Door Controller, AXIS A1210-B Network Door Controller, AXIS A1601 Network Door Controller, AXIS A1610 (-B) Network Door Controller, AXIS A8207-VE Network Video Door Station, and AXIS A8207-VE Mk II Network Video Door Station, with specific vulnerable software versions listed for each product.

Exploitation Mechanism

Attackers can exploit this vulnerability by sending malicious OSDP messages to the Axis Network Door Controllers and Intercoms, leading to the temporary unavailability of door-controlling functionalities.

Mitigation and Prevention

To mitigate the impact of CVE-2023-21405, immediate steps should be taken along with implementing long-term security practices and applying necessary patches and updates to the affected devices.

Immediate Steps to Take

Organizations should review the Axis security advisory related to CVE-2023-21405 for specific mitigation steps and guidance on addressing the vulnerability promptly.

Long-Term Security Practices

Implementing robust cybersecurity measures, regular security assessments, and ensuring up-to-date security protocols can help prevent similar vulnerabilities and enhance overall security posture.

Patching and Updates

It is crucial for organizations to apply patches and updates provided by Axis Communications AB for the affected Network Door Controllers and Network Video Door Stations to eliminate the vulnerability and enhance device security.