Statement from Axis Communications on the discovered BOA webserver vulnerabilities (CVE-2017-9833 and CVE-2021-33558). Axis has been using the BOA webserver in its legacy products from firmware 5.65 and lower. However, these products are not affected as the required 3rd party components for exploiting the vulnerabilities are not used in Axis products. In addition to that, further protection is provided by performing input validation on API-interfaces. Newer Axis products with firmware 5.70 and higher utilize the Apache webserver and the BOA webserver was therefore removed.
 backup.html, preview.html, js/log.js, log.html, email.html, online-users.html, config.js and /cgi-bin/wapopen are not used