एक्सेस कम्युनिकेशन की ओर से किए गए वार्षिक पेनिट्रेशन टेस्ट के दौरान, ट्रूसेक ने VAPIX डिवाइस कॉन्फ़िगरेशन फ्रेमवर्क में एक खामी पाई जो विशेषाधिकार वृद्धि (Privilege Escalation) की अनुमति देती है, जिससे एक निम्न

Successful exploitation of CVE-2025-0358 grants an attacker unauthorized administrator access to the affected Axis device. This could lead to complete control over the device's configuration, including network settings, user accounts, and firmware updates. An attacker could then use this compromised device as a pivot point to access other systems on the network, potentially leading to widespread data breaches and system disruption. The impact is particularly severe in environments where Axis devices are used for critical security functions, such as surveillance or access control.

Organizations utilizing Axis devices with the VAPIX Device Configuration framework in versions 12.0.0 through 12.4.0 are at risk. This includes deployments in surveillance systems, building management systems, and other applications where Axis devices are integrated. Legacy configurations with default or weak passwords are particularly vulnerable.

1. 2025-06-02Disclosure

   disclosure

1. आरक्षित2025-01-09
2. प्रकाशित2025-06-02
3. EPSS अद्यतन2026-04-02

The primary mitigation for CVE-2025-0358 is to upgrade the Axis VAPIX Device Configuration framework to version 12.4.0 or later. If immediate upgrading is not possible, consider implementing stricter access controls and privilege separation to limit the potential impact of a successful attack. Review user accounts and permissions, ensuring that only authorized personnel have administrative access. While a direct WAF rule is unlikely, network segmentation can limit lateral movement from a compromised device. After upgrading, verify the fix by attempting to execute a privileged operation with a non-administrator user account and confirming that access is denied.