Axis: Security Vulnerabilities
The communication protocol used between client
and server had a flaw that could be leveraged to execute a man in the middle attack.
CVSS Score
6.8
EPSS Score
0.003
Published
2025-07-11
The communication protocol used between the
server process and the service control had a flaw that could lead to a local privilege escalation.
CVSS Score
4.8
EPSS Score
0.002
Published
2025-07-11
The AXIS Camera Station Server had a flaw that allowed
to bypass authentication that is normally required.
CVSS Score
5.3
EPSS Score
0.006
Published
2025-07-11
The VAPIX Device Configuration framework allowed a privilege escalation, enabling a lower-privileged user to gain administrator privileges.
CVSS Score
9.4
EPSS Score
0.003
Published
2025-06-02
During an annual penetration test conducted on behalf of Axis Communication, Truesec discovered a flaw in the VAPIX Device Configuration framework that allowed a privilege escalation, enabling a lower-privileged user to gain administrator privileges.
CVSS Score
8.8
EPSS Score
0.002
Published
2025-06-02
Gee-netics, member of AXIS Camera Station Pro Bug Bounty Program, has identified an issue with a specific file that the server is using. A non-admin user can modify this file to either create files or change the content of files in an admin-protected location.
Axis has released a patched version for the highlighted flaw. Please
refer to the Axis security advisory for more information and solution.
CVSS Score
6.1
EPSS Score
0.002
Published
2025-04-23
Gee-netics, member of AXIS Camera Station Pro Bug Bounty Program, has found that it is possible for a non-admin user to remove system files causing a boot loop by redirecting a file deletion when recording video.
Axis has released a patched version for the highlighted flaw. Please
refer to the Axis security advisory for more information and solution.
CVSS Score
5.9
EPSS Score
0.002
Published
2025-04-23
During an annual penetration test conducted on behalf of Axis Communications, Truesec discovered a flaw in the VAPIX Device Configuration framework that allowed for unauthenticated username enumeration through the VAPIX Device Configuration SSH Management API.
CVSS Score
4.3
EPSS Score
0.003
Published
2025-04-08
51l3nc3, a member of the AXIS OS Bug Bounty Program, has found that the VAPIX API uploadoverlayimage.cgi did not have sufficient input validation to allow an attacker to upload files to block access to create image overlays in the web interface of the Axis device.
CVSS Score
4.3
EPSS Score
0.004
Published
2025-04-08
During an annual penetration test conducted on behalf of Axis Communication, Truesec discovered a flaw in the ACAP Application framework that allowed applications to access restricted D-Bus methods within the framework.
Axis has released patched AXIS OS versions for the highlighted flaw. Please refer to the Axis security advisory for more information and solution.
CVSS Score
8.5
EPSS Score
0.001
Published
2025-03-04