CVE-2021-31988 is a critical vulnerability affecting Axis OS, Axis OS 2016, Axis OS 2018, and Axis OS 2020, where improper validation of a user-controlled parameter in SMTP test functionality allows for the injection of arbitrary SMTP headers via CRLF characters. This flaw carries a high CVSS score of 8.8, indicating a network-based attack with low complexity, requiring user interaction, and potentially leading to high impact on confidentiality, integrity, and availability. While there is no evidence of active exploitation or public exploit code (Metasploit, Nuclei, ExploitDB), the vulnerability has garnered significant community discussion and media coverage, including articles detailing its potential for remote code execution and data theft.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
< 10.7CPE matchmatch criteria | cpe:2.3:o:axis:axis_os:*:*:*:*:active:*:*:* | ||
< 6.50.5.5CPE matchmatch criteria | cpe:2.3:o:axis:axis_os_2016:*:*:*:*:lts:*:*:* | ||
< 8.40.4.3CPE matchmatch criteria | cpe:2.3:o:axis:axis_os_2018:*:*:*:*:lts:*:*:* | ||
< 9.80.3.5CPE matchmatch criteria | cpe:2.3:o:axis:axis_os_2020:*:*:*:*:lts:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.2 Bluesky, 0.1 Mastodon, and 0.2 GitHub mentions.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.1 Security Researcher mentions.
Remediation records are not available for this CVE.