The AXIS Camera Station Server had a flaw that allowed
to bypass authentication that is normally required.

CVE-2025-30026 is a medium-severity vulnerability identified in Axis Communications AB's AXIS Camera Station Pro software versions prior to 6.9. The vulnerability is classified under CWE-288, which pertains to authentication bypass using an alternate path or channel. Specifically, this flaw allows an attacker to circumvent the authentication mechanisms that are normally required to access the AXIS Camera Station Server. The CVSS 4.0 base score is 5.3, reflecting a medium impact level. The vector string indicates that the attack requires adjacent network access (AV:A), has low attack complexity (AC:L), does not require authentication (PR:N), no user interaction (UI:N), and does not affect confidentiality, integrity, or availability directly (VC:N/VI:N/VA:N). However, the scope is limited (S:U), and the impact is limited to a low level (SI:L/SA:L), suggesting that the attacker can gain some level of unauthorized access or functionality but without full system compromise or data breach. The vulnerability arises because the software improperly handles authentication checks, allowing an attacker to exploit an alternate communication path or channel to bypass login requirements. This could enable unauthorized viewing or control of surveillance cameras managed by the AXIS Camera Station Pro server. No known exploits are currently reported in the wild, and no patches or mitigation links are provided yet. Given the nature of the product—a video management system used for security surveillance—unauthorized access could lead to privacy violations, unauthorized monitoring, or manipulation of camera feeds.

CVE Database V5

Detailed information about CVE-2025-30026: CWE-288: Authentication Bypass Using an Alternate Path or Channel in Axis Communications AB AXIS Camera Station Pro a

CVE-2025-30026: CWE-288: Authentication Bypass Using an Alternate Path or Channel in Axis Communications AB AXIS Camera Station Pro - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2025-30026: CWE-288: Authentication Bypass Using an Alternate Path or Channel in Axis Communications AB AXIS Camera Station Pro

The communication protocol used between the
server process and the service control had a flaw that could lead to a local privilege escalation.

CVE-2025-30025 is a vulnerability identified in Axis Communications AB's AXIS Device Manager, specifically affecting versions prior to 5.32. The root cause is a flaw in the communication protocol between the server process and the service control component, which involves deserialization of untrusted data (CWE-502). Deserialization vulnerabilities occur when untrusted input is used to reconstruct objects, potentially allowing attackers to manipulate the process to execute arbitrary code or escalate privileges. In this case, the vulnerability enables local privilege escalation, meaning an attacker with limited access to the system could exploit this flaw to gain higher privileges, potentially administrative rights. The CVSS v4.0 score is 4.8 (medium severity), reflecting that exploitation requires local access (AV:L), low attack complexity (AC:L), no user interaction (UI:N), and privileges at a low level (PR:L). The impact on confidentiality, integrity, and availability is limited but non-negligible, with partial impacts on integrity and availability. No known exploits are currently reported in the wild, and no patches have been linked yet. The vulnerability's exploitation vector is local, so remote exploitation is not feasible without prior access. However, once exploited, it could allow attackers to bypass security controls, modify system configurations, or disrupt device management operations. AXIS Device Manager is used to manage and monitor Axis network devices such as cameras and access control systems, which are critical in physical security environments. Therefore, this vulnerability could indirectly affect the security posture of organizations relying on these devices for surveillance and access control.

Detailed information about CVE-2025-30025: CWE-502 Deserialization of Untrusted Data in Axis Communications AB AXIS Device Manager affecting Axis Communications

CVE-2025-30025: CWE-502 Deserialization of Untrusted Data in Axis Communications AB AXIS Device Manager - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2025-30025: CWE-502 Deserialization of Untrusted Data in Axis Communications AB AXIS Device Manager

The communication protocol used between client
and server had a flaw that could be leveraged to execute a man in the middle attack.

CVE-2025-30024 is a vulnerability classified under CWE-295, indicating improper certificate validation in the AXIS Device Manager software developed by Axis Communications AB. The flaw resides in the communication protocol between the client and server components of the AXIS Device Manager, specifically in versions prior to 5.32. Improper certificate validation means that the software does not correctly verify the authenticity of TLS/SSL certificates during the establishment of secure connections. This weakness can be exploited by an attacker to perform a man-in-the-middle (MITM) attack, intercepting, modifying, or injecting malicious data into the communication stream without detection. The CVSS v3.1 base score for this vulnerability is 6.8, categorized as medium severity, with the vector indicating network attack vector (AV:N), high attack complexity (AC:H), no privileges required (PR:N), user interaction required (UI:R), unchanged scope (S:U), and high impact on confidentiality and integrity (C:H/I:H), but no impact on availability (A:N). The vulnerability does not currently have known exploits in the wild, but the potential for exploitation exists due to the nature of the flaw. The absence of a patch link suggests that a fix may not yet be publicly available or is pending release. AXIS Device Manager is a centralized management tool for Axis network devices, commonly used in surveillance and security infrastructure to manage cameras and related equipment. The improper certificate validation could allow attackers to intercept sensitive management traffic, potentially leading to unauthorized access or manipulation of surveillance devices.

Detailed information about CVE-2025-30024: CWE-295 Improper Certificate Validation in Axis Communications AB AXIS Device Manager affecting Axis Communications A

CVE-2025-30024: CWE-295 Improper Certificate Validation in Axis Communications AB AXIS Device Manager - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2025-30024: CWE-295 Improper Certificate Validation in Axis Communications AB AXIS Device Manager

The communication protocol used between client and server had a flaw that could lead to an authenticated user performing a remote code execution attack.

CVE-2025-30023 is a critical vulnerability identified in Axis Communications AB's AXIS Camera Station Pro software versions prior to 6.9. The root cause of this vulnerability is a deserialization flaw (CWE-502) in the communication protocol between the client and server components of the product. Specifically, the protocol improperly handles untrusted serialized data, allowing an authenticated user to exploit this flaw to perform remote code execution (RCE) on the server. This vulnerability requires the attacker to have legitimate credentials (low privilege required) but does not require any user interaction beyond authentication. The CVSS v3.1 score of 9.0 reflects the critical nature of this vulnerability, with high impact on confidentiality, integrity, and availability, and a scope that affects the entire system. The vulnerability allows an attacker to execute arbitrary code remotely, potentially leading to full system compromise, data exfiltration, or disruption of video surveillance services. The flaw arises from unsafe deserialization practices, which can allow crafted serialized objects to trigger malicious code execution during the deserialization process. No known public exploits have been reported yet, but the criticality and nature of the vulnerability make it a high-priority risk for organizations using this software.

Detailed information about CVE-2025-30023: CWE-502 Deserialization of Untrusted Data in Axis Communications AB AXIS Camera Station Pro affecting Axis Communicat

CVE-2025-30023: CWE-502 Deserialization of Untrusted Data in Axis Communications AB AXIS Camera Station Pro - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2025-30023: CWE-502 Deserialization of Untrusted Data in Axis Communications AB AXIS Camera Station Pro

Installation file of ESET security products on Windows 

allow an attacker to misuse to delete an arbitrary file without having the permissions to do so.

Detailed information about CVE-2025-5028: CWE-269 Improper Privilege Management in ESET, spol. s.r.o ESET NOD32 Antivirus affecting ESET, spol. s.r.o ESET NOD32

CVE-2025-5028: CWE-269 Improper Privilege Management in ESET, spol. s.r.o ESET NOD32 Antivirus

CVE-2025-5028: CWE-269 Improper Privilege Management in ESET, spol. s.r.o ESET NOD32 Antivirus

Description

Technical Details

Related Threats

CVE-2025-30026: CWE-288: Authentication Bypass Using an Alternate Path or Channel in Axis Communications AB AXIS Camera Station Pro

CVE-2025-30025: CWE-502 Deserialization of Untrusted Data in Axis Communications AB AXIS Device Manager

CVE-2025-30024: CWE-295 Improper Certificate Validation in Axis Communications AB AXIS Device Manager

CVE-2025-30023: CWE-502 Deserialization of Untrusted Data in Axis Communications AB AXIS Camera Station Pro

CVE-2025-7401: CWE-798 Use of Hard-coded Credentials in aa-team Premium Age Verification / Restriction for WordPress

Actions

External Links

Need enhanced features?

Latest Threats

Keyboard Shortcuts

Navigation

Search & Filters

UI Controls

Accessibility