This vulnerability (CVE-2026-0541) in AXIS OS 12.0.0 involves incorrect permission assignment (CWE-732) for critical resources during the installation of ACAP applications. Improper input validation allows these applications to escalate privileges if the device permits unsigned ACAP app installation and a user installs a malicious app. The CVSS 3.1 score is 6.7 (medium), reflecting local attack vector, low attack complexity, high privileges required, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability. No patch or official remediation guidance is currently available from the vendor.

Successful exploitation can lead to privilege escalation on the affected device, potentially compromising confidentiality, integrity, and availability of the system. However, exploitation requires specific conditions: the device must allow unsigned ACAP application installation, and an attacker must convince a user to install a malicious application. There are no known active exploits in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, mitigate risk by disabling the installation of unsigned ACAP applications on AXIS OS devices and educating users to avoid installing untrusted applications.