CVE-2025-0358: Privilege Escalation in Axis VAPIX Device Configuration

Successful exploitation of CVE-2025-0358 grants an attacker unauthorized administrator access to the affected Axis device. This could lead to complete control over the device's configuration, including network settings, user accounts, and firmware updates. An attacker could then use this compromised device as a pivot point to access other systems on the network, potentially leading to widespread data breaches and system disruption. The impact is particularly severe in environments where Axis devices are used for critical security functions, such as surveillance or access control.

1. Reserved2025-01-09
2. Published2025-06-02
3. EPSS updated2026-04-02

The primary mitigation for CVE-2025-0358 is to upgrade the Axis VAPIX Device Configuration framework to version 12.4.0 or later. If immediate upgrading is not possible, consider implementing stricter access controls and privilege separation to limit the potential impact of a successful attack. Review user accounts and permissions, ensuring that only authorized personnel have administrative access. While a direct WAF rule is unlikely, network segmentation can limit lateral movement from a compromised device. After upgrading, verify the fix by attempting to execute a privileged operation with a non-administrator user account and confirming that access is denied.