MEDIUM🇵🇱 Wersja polska

CVE-2025-5452

CVSS 6.6v3.1pub. 2025-11-11upd. 2025-11-24

A malicious ACAP application can gain access to admin-level service account credentials used by legitimate ACAP applications, leading to potential privilege escalation of the malicious ACAP application. This vulnerability can only be exploited if the Axis device is configured to allow the installation of unsigned ACAP applications, and if an attacker convinces the victim to install a malicious ACAP application.

CVSS Vector
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

  • Axis A1210 \( B\)

    HW
    Axis
    all versions

  • Axis A1214

    HW
    Axis
    all versions

  • Axis A1601

    HW
    Axis
    all versions

  • Axis A1610 \( B\)

    HW
    Axis
    all versions

  • Axis A1710 B

    HW
    Axis
    all versions

  • Axis A1810 B

    HW
    Axis
    all versions

  • Axis A8207 Ve Mk Ii

    HW
    Axis
    all versions

  • Axis Os

    OS
    Axis
    12.0.0 – 12.6.69 (excl.)

  • Axis C1110 E

    HW
    Axis
    all versions

  • Axis C1111 E

    HW
    Axis
    all versions

  • Axis C1210 E

    HW
    Axis
    all versions

  • Axis C1211 E

    HW
    Axis
    all versions

  • Axis C1310 E Mk Ii

    HW
    Axis
    all versions

  • Axis C1410 Mk Ii

    HW
    Axis
    all versions

  • Axis C1510

    HW
    Axis
    all versions

  • Axis C1511

    HW
    Axis
    all versions

  • Axis C1610 Ve

    HW
    Axis
    all versions

  • Axis C1710

    HW
    Axis
    all versions

  • Axis C1720

    HW
    Axis
    all versions

  • Axis C6110

    HW
    Axis
    all versions

  • Axis C8110

    HW
    Axis
    all versions

  • Axis C8210

    HW
    Axis
    all versions

  • Axis D1110

    HW
    Axis
    all versions

  • Axis D201 S Xpt Q6075

    HW
    Axis
    all versions

  • Axis D2110 Ve

    HW
    Axis
    all versions

  • Axis D2210 Ve

    HW
    Axis
    all versions

  • Axis D3110 Mk Ii

    HW
    Axis
    all versions

  • Axis D4100 Ve Mk Ii

    HW
    Axis
    all versions

  • Axis D4200 Ve

    HW
    Axis
    all versions

  • Axis D6310

    HW
    Axis
    all versions
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
Tags
LPE
CWE
References

Related vulnerabilities

CVE-2025-0324CRITICAL9.4PL ✓same product

Privilege escalation w VAPIX Device Configuration Framework (Axis OS)

CVE-2023-21413CRITICAL9.1PL ✓same product

Command Injection w AXIS OS podczas instalacji aplikacji ACAP — RCE

CVE-2025-11142HIGH7.1same product

The VAPIX API mediaclip.cgi that did not have a sufficient input validation allowing for a possible remote cod...

CVE-2025-0358HIGH8.8same product

During an annual penetration test conducted on behalf of Axis Communication, Truesec discovered a flaw in the ...

CVE-2025-0359HIGH8.5same product

During an annual penetration test conducted on behalf of Axis Communication, Truesec discovered a flaw in the ...