A VAPIX API parameter had improper input validation which could allow code execution and potentially lead to a privilege escalation. This flaw can only be exploited after authenticating with an administrator-privileged service account.
The ACAP framework contains a Time-of-Check to Time-of-Use (TOCTOU) race condition, which could potentially lead to privilege escalation. This vulnerability can only be exploited if the Axis device is configured to allow the installation of unsigned ACAP applications, and if an attacker convinces the victim to install a malicious ACAP application.
An ACAP configuration file lacks input validation, which could potentially lead to privilege escalation. This vulnerability can only be exploited if the Axis device is configured to allow the installation of unsigned ACAP applications, and if an attacker convinces the victim to install a malicious ACAP application.
The ACAP framework contains a Time-of-Check to Time-of-Use (TOCTOU) race condition, which could potentially lead to privilege escalation. This vulnerability can only be exploited if the Axis device is configured to allow the installation of unsigned ACAP applications, and if an attacker convinces the victim to install a malicious ACAP application.
The Signed Video Framework contained a buffer overflow issue
which could lead the application using this framework to crash. The issue exclusively affects the tools used for the validation of signed content. The AXIS OS device's signed video functionality remains unaffected.
The Device Configuration Framework is vulnerable to an authentication bypass flaw. This flaw can only be exploited after authenticating with a viewer-privileged service account.
A configuration file on the local file system had improper input validation which could allow code execution and potentially lead to privilege escalation. This vulnerability can only be exploited if an attacker can log in to the Axis device using SSH.
An ACAP configuration file lacked sufficient input validation, which could allow a path traversal attack leading to potential privilege escalation. This vulnerability can only be exploited if the Axis device is configured to allow the installation of unsigned ACAP applications, and if an attacker convinces the victim to install a malicious ACAP application.
An ACAP configuration file lacked sufficient input validation, which could allow command injection and potentially lead to privilege escalation. This vulnerability can only be exploited if the Axis device is configured to allow the installation of unsigned ACAP applications, and if an attacker convinces the victim to install a malicious ACAP application.
ACAP applications can gain elevated privileges due to improper input validation during the installation process, potentially leading to privilege escalation. This vulnerability can only be exploited if the Axis device is configured to allow the installation of unsigned ACAP applications, and if an attacker convinces the victim to install a malicious ACAP application.
CVE-2025-12063 is an authorization bypass vulnerability in Axis Communications AB's AXIS Camera Station Pro version 6. It allows a non-admin user to modify or remove certain data objects without proper permissions due to an insecure direct object reference (CWE-639). The vulnerability requires low privileges and no user interaction but can only be exploited remotely with adjacent network access. While it does not impact confidentiality or availability, it can cause integrity loss by unauthorized modification of data. No known exploits are currently reported in the wild, and no patches have been published yet. European organizations using AXIS Camera Station Pro version 6 should be cautious, especially those with extensive physical security deployments. Mitigation involves strict access control reviews, network segmentation, and monitoring for suspicious activities. Countries with high adoption of Axis products and critical infrastructure reliance on video surveillance, such as Germany, France, and the UK, are most likely affected. The CVSS score is 5.7, indicating a medium severity level.
CVE-2025-12757 is a medium-severity path traversal vulnerability in Axis Communications AB's AXIS Camera Station Pro version 6. It allows a non-admin user with limited privileges to access information beyond their authorization by exploiting improper pathname restrictions. The vulnerability does not require user interaction and has a CVSS score of 4.6, indicating limited confidentiality and integrity impact without affecting availability. No known exploits are currently in the wild. European organizations using AXIS Camera Station Pro, especially in critical infrastructure and surveillance sectors, should prioritize patching or applying mitigations to prevent unauthorized data exposure. Countries with high adoption of Axis products and strategic security interests are at greater risk. Mitigations include strict access control reviews, network segmentation, and monitoring for unusual file access patterns.
CVE-2025-13064 is a medium severity vulnerability in Axis Communications AB's AXIS Camera Station Pro version 6. It involves a server-side injection caused by an uncaught exception (CWE-248) that allows a malicious administrator, using a tampered client, to inject and execute malicious scripts on the server. The vulnerability requires high privileges (admin access) and no user interaction. Exploitation impacts availability but not confidentiality or integrity, and no known exploits are currently in the wild. The attack vector is remote and requires an authenticated attacker using a compromised client. European organizations using AXIS Camera Station Pro for video surveillance could face service disruptions if exploited. Mitigation involves ensuring client integrity, restricting admin client usage, and monitoring for anomalous server behavior. Countries with high adoption of Axis surveillance products and critical infrastructure reliance on video monitoring, such as Germany, France, the UK, and the Netherlands, are most likely affected. Given the limited impact scope and exploitation complexity, the severity is medium.
The VAPIX API mediaclip.cgi that did not have a sufficient input validation allowing for a possible remote code execution. This flaw can only be exploited after authenticating with an operator- or administrator- privileged service account.
The VAPIX Edge storage API that allowed a privilege escalation, enabling a VAPIX administrator-privileged user to gain Linux Root privileges. This flaw can only be exploited after authenticating with an administrator-privileged service account.
It was possible to upload files with a specific name to a temporary directory, which may result in process crashes and impact usability. This flaw can only be exploited after authenticating with an operator- or administrator-privileged service account.
The VAPIX API port.cgi did not have sufficient input validation, which may result in process crashes and impact usability. This vulnerability can only be exploited after authenticating with a viewer- operator- or administrator-privileged service account.
AXIS Optimizer was vulnerable to an unquoted search path vulnerability, which could potentially lead to privilege escalation within Microsoft Windows operating system. This vulnerability can only be exploited if the attacker has access to the local Windows machine and sufficient access rights (administrator) to write data into the installation path of AXIS Optimizer.
An ACAP configuration file has improper permissions and lacks input validation, which could potentially lead to privilege escalation. This vulnerability can only be exploited if the Axis device is configured to allow the installation of unsigned ACAP applications, and if an attacker convinces the victim to install a malicious ACAP application.
