Während eines jährlichen Penetrationstests, der im Auftrag von Axis Communication durchgeführt wurde, entdeckte Truesec einen Fehler im VAPIX Device Configuration Framework, der eine Berechtigungssteigerung ermöglichte und einem Benutzer mit geringeren

Successful exploitation of CVE-2025-0358 grants an attacker unauthorized administrator access to the affected Axis device. This could lead to complete control over the device's configuration, including network settings, user accounts, and firmware updates. An attacker could then use this compromised device as a pivot point to access other systems on the network, potentially leading to widespread data breaches and system disruption. The impact is particularly severe in environments where Axis devices are used for critical security functions, such as surveillance or access control.

Organizations utilizing Axis devices with the VAPIX Device Configuration framework in versions 12.0.0 through 12.4.0 are at risk. This includes deployments in surveillance systems, building management systems, and other applications where Axis devices are integrated. Legacy configurations with default or weak passwords are particularly vulnerable.

1. 2025-06-02Disclosure

   disclosure

1. Reserviert2025-01-09
2. Veröffentlicht2025-06-02
3. EPSS aktualisiert2026-04-02

The primary mitigation for CVE-2025-0358 is to upgrade the Axis VAPIX Device Configuration framework to version 12.4.0 or later. If immediate upgrading is not possible, consider implementing stricter access controls and privilege separation to limit the potential impact of a successful attack. Review user accounts and permissions, ensuring that only authorized personnel have administrative access. While a direct WAF rule is unlikely, network segmentation can limit lateral movement from a compromised device. After upgrading, verify the fix by attempting to execute a privileged operation with a non-administrator user account and confirming that access is denied.