DeutschShown in its original language — a full translation is planned for a future version.
Axis Axis OS: Mehrere Schwachstellen
view advisory published 2025-11-10
Ein Angreifer kann mehrere Schwachstellen in Axis Axis OS ausnutzen, um beliebigen Programmcode auszuführen, erweiterte Berechtigungen (sogar Administratorrechte) zu erlangen, Daten zu manipulieren, vertrauliche Informationen offenzulegen und einen Denial-of-Service-Zustand zu verursachen.
01
describes (11)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2025-9524US | — | — | ||
The VAPIX API port.cgi did not have sufficient input validation, which may result in process crashes and impact usability. This vulnerability can only be exploited after authentica… | ||||
| CVE-2025-9055US | — | — | ||
The VAPIX Edge storage API that allowed a privilege escalation, enabling a VAPIX administrator-privileged user to gain Linux Root privileges. This flaw can only be exploited after… | ||||
| CVE-2025-8998US | — | — | ||
It was possible to upload files with a specific name to a temporary directory, which may result in process crashes and impact usability. This flaw can only be exploited after authe… | ||||
| CVE-2025-8108US | — | — | ||
An ACAP configuration file has improper permissions and lacks input validation, which could potentially lead to privilege escalation. This vulnerability can only be exploited if th… | ||||
| CVE-2025-6779US | — | — | ||
An ACAP configuration file has improper permissions, which could allow command injection and potentially lead to privilege escalation. This vulnerability can only be exploited if t… | ||||
| CVE-2025-6571US | — | — | ||
A 3rd-party component exposed its password in process arguments, allowing for low-privileged users to access it. | ||||
| CVE-2025-6298US | — | — | ||
ACAP applications can gain elevated privileges due to improper input validation, potentially leading to privilege escalation. This vulnerability can only be exploited if the Axis d… | ||||
| CVE-2025-5718US | — | — | ||
The ACAP Application framework could allow privilege escalation through a symlink attack. This vulnerability can only be exploited if the Axis device is configured to allow the ins… | ||||
| CVE-2025-5454US | medium6.7 | — | ||
An ACAP configuration file lacked sufficient input validation, which could allow a path traversal attack leading to potential privilege escalation. This vulnerability can only be e… | ||||
| CVE-2025-5452US | medium6.6 | — | ||
A malicious ACAP application can gain access to admin-level service account credentials used by legitimate ACAP applications, leading to potential privilege escalation of the malic… | ||||
| CVE-2025-4645US | — | — | ||
An ACAP configuration file lacked sufficient input validation, which could allow for arbitrary code execution. This vulnerability can only be exploited if the Axis device is config… | ||||
02
references
External citations — patches, advisories, analysis.
- WID-SEC-W-2025-2546 - CSAF Versionself
- WID-SEC-2025-2546 - Portal Versionself
- Axix Security Advisories vom 2025-11-10external
- Axix Security Advisories vom 2025-11-10external
- Axix Security Advisories vom 2025-11-10external
- Axix Security Advisories vom 2025-11-10external
- Axix Security Advisories vom 2025-11-10external
- Axix Security Advisories vom 2025-11-10external
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan