VulnerabilityPublished 11 Nov 2025Updated 14 Nov 2025

CVE-2025-10714: AXIS Optimizer · Unquoted Search Path or Element

Affects AXIS OptimizerSource CVE Database V5

Not known to be exploited · CVSS 8.4 High.

Data as of 26 Oct 2026, 14:05 UTC

CVSS 3.1 base score

8.4High

How severe the flaw is on the 0–10 CVSS scale.

EPSS: 0.1% chance of exploitation in 30 days – higher than 2% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:H

Attack Vector: Local
Attack Complexity: Low
Privileges Required: Low
User Interaction: None
Scope: Changed
Confidentiality: None
Integrity: High
Availability: High

Bold values are the worst case: easiest to exploit or largest impact.

Attack Vector: Local: The vulnerable component is not bound to the network stack and the attacker’s path is via read/write/execute capabilities. Either: the attacker exploits the vulnerability by accessing the target system locally (e.g., keyboard, console), or remotely (e.g., SSH); or the attacker relies on User Interaction by another person to perform actions required to exploit the vulnerability (e.g., tricking a legitimate user into opening a malicious document).
Attack Complexity: Low: Specialized access conditions or extenuating circumstances do not exist. An attacker can expect repeatable success against the vulnerable component.
Privileges Required: Low: The attacker is authorized with (i.e., requires) privileges that provide basic user capabilities that could normally affect only settings and files owned by a user. Alternatively, an attacker with Low privileges may have the ability to cause an impact only to non-sensitive resources.
User Interaction: None: The vulnerable system can be exploited without any interaction from any user.
Scope: Changed: An exploited vulnerability can affect resources beyond the security scope managed by the security authority of the vulnerable component. In this case, the vulnerable component and the impacted component are different and managed by different security authorities.
Confidentiality: None: There is no loss of confidentiality within the impacted component.
Integrity: High: There is a total loss of integrity, or a complete loss of protection. For example, the attacker is able to modify any/all files protected by the impacted component. Alternatively, only some files can be modified, but malicious modification would present a direct, serious consequence to the impacted component.
Availability: High: There is total loss of availability, resulting in the attacker being able to fully deny access to resources in the impacted component; this loss is either sustained (while the attacker continues to deliver the attack) or persistent (the condition persists even after the attack has completed). Alternatively, the attacker has the ability to deny some availability, but the loss of availability presents a direct, serious consequence to the impacted component (e.g., the attacker cannot disrupt existing connections, but can prevent new connections; the attacker can repeatedly exploit a vulnerability that, in each instance of a successful attack, leaks a only small amount of memory, but after repeated exploitation causes a service to become completely unavailable).

Definitions: FIRST CVSS v3.1 specification.

Exploitation evidence

Disclosed: evidence found.
CVE published 11 Nov 2025
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponised: Public exploit code exists in Metasploit or Exploit-DB, or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

What to do

Affected software

Product	Affected	Fixed in
Axis Communications AB AXIS Optimizer	Affected =0	Fixed in–

AI-suggested

To mitigate this vulnerability, European organizations should first verify if AXIS Optimizer is deployed within their environment and identify the installation paths. Immediate steps include: 1) Restrict write permissions on the AXIS Optimizer installation directory to trusted administrators only, preventing unauthorized users from placing malicious executables. 2) Manually inspect and correct any unquoted paths in service configurations, startup scripts, or environment variables related to AXIS Optimizer by enclosing paths with spaces in double quotes. 3) Implement application whitelisting or endpoint protection solutions that can detect and block unauthorized executable files in critical directories. 4) Monitor local user activities and file system changes in the AXIS Optimizer directories for suspicious behavior. 5) Coordinate with Axis Communications for official patches or updates and apply them promptly once available. 6) Educate local users and administrators about the risks of local privilege escalation and enforce the principle of least privilege to minimize attack surface. 7) Consider isolating systems running AXIS Optimizer from general user environments to limit local access opportunities.

Description

AXIS Optimizer was vulnerable to an unquoted search path vulnerability, which could potentially lead to privilege escalation within Microsoft Windows operating system. This vulnerability can only be exploited if the attacker has access to the local Windows machine and sufficient access rights (administrator) to write data into the installation path of AXIS Optimizer.

Impact

For European organizations, the impact of this vulnerability can be substantial, especially in sectors relying on Axis Communications' AXIS Optimizer software for video surveillance or network device management. Successful exploitation could allow attackers to escalate privileges from a limited user account to higher administrative levels, potentially leading to unauthorized system modifications, disruption of security monitoring functions, or deployment of persistent malware. This could compromise the confidentiality, integrity, and availability of critical security infrastructure. Organizations with shared or multi-user Windows environments are particularly at risk, as local access might be easier to obtain. The vulnerability could also facilitate lateral movement within networks if attackers gain elevated privileges on one machine. Given the high CVSS score and changed scope, the threat could extend beyond the AXIS Optimizer application, affecting broader system components and services. The absence of known exploits in the wild currently reduces immediate risk but does not eliminate the potential for future exploitation, especially as attackers often target unquoted search path vulnerabilities once disclosed.

Summary

CVE-2025-10714 is an unquoted search path vulnerability (CWE-428) found in the AXIS Optimizer product by Axis Communications AB. This vulnerability arises when the software's executable or related binaries are located in a directory path that contains spaces but is not enclosed in quotes in system or application startup scripts or service configurations. On Windows systems, this can cause the OS to incorrectly resolve the executable path, allowing an attacker to place a malicious executable in a higher-priority directory in the search path. In this case, an attacker with local access and the ability to write to the AXIS Optimizer installation directory can exploit this flaw to escalate privileges. The CVSS 3.1 base score is 8.4 (high), reflecting the vulnerability's potential to compromise system integrity and availability without requiring user interaction. The attack vector is local (AV:L), with low attack complexity (AC:L), requiring privileges (PR:L) but no user interaction (UI:N). The scope is changed (S:C), indicating that exploitation affects resources beyond the initially vulnerable component. Although no public exploits are known yet, the vulnerability poses a significant risk in environments where local access is possible, such as shared workstations or compromised accounts. The vulnerability was published on November 11, 2025, and no patches or mitigations are currently linked, emphasizing the need for proactive defense measures.

CWE-428Unquoted Search Path or Element (opens in a new tab)
Base weakness
The product uses a search path that contains an unquoted element, in which the element contains whitespace or other separators. This can cause the product to access resources in a parent path.
Implementation
Properly quote the full search path before executing a program on the system.
Implementation · Input Validation
Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does.
Implementation · Input Validation
Inputs should be decoded and canonicalized to the application's current internal representation before being validated (CWE-180). Make sure that the application does not decode the same input twice (CWE-174).
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).

References

axis.com/dam/public/a2/c7/8c/cve-2025-10714pdf-en-US-504221.pdf (opens in a new tab)

Community reviews

Loading reviews…

Exploitation evidence

What to do

Affected software

Description

AI analysisMachine-generated, updated 18 Nov 2025, 07:48 UTC

WeaknessesCWE-428

Technical details

References

Community reviews

Related threats