CVE-2025-0324

The VAPIX Device Configuration Framework improperly verifies the privilege level of the calling user (CWE-791 — incomplete filtering of special elements). This error allows an attacker operating as a low-privilege user to escalate to administrator level (privilege escalation) without the need to provide additional credentials. The attack is possible remotely, over the network, without any interaction from the victim.

An attacker gains full administrator privileges on an Axis device, enabling them to take complete control of device configuration, read sensitive data, and potentially modify the system.

Apply patches available from the manufacturer according to the references — specific versions fixing the vulnerability are provided in Axis's official security bulletin.

Axis OS 2024 and Axis OS — specific versions indicated in the manufacturer's references (https://www.axis.com/dam/public/04/f3/1c/cve-2025-0324pdf-en-US-483807.pdf)