CVE-2025-6779

An ACAP configuration file has improper permissions, which could allow command injection and potentially lead to privilege escalation. This vulnerability can only be exploited if the Axis device is configured to allow the installation of unsigned ACAP applications, and if an attacker convinces th...

CVE-2025-6779

CVE-2025-6779 affects Axis devices running Axis OS where an ACAP configuration file has improper permissions. The underlying issue could permit command injection and privilege escalation, but exploitation is contingent on the device being configured to allow unsigned ACAP applications and an atta...

CVE-2025-5452

Axis devices running ACAP with unsigned app installation enabled are reported to be vulnerable to a malicious ACAP application that can obtain admin-level service account credentials used by legitimate ACAP apps, potentially enabling privilege escalation. Exploitation requires convincing a user t...

CVE-2025-5452

A malicious ACAP application can gain access to admin-level service account credentials used by legitimate ACAP applications, leading to potential privilege escalation of the malicious ACAP application. This vulnerability can only be exploited if the Axis device is configured to allow the...

CVE-2025-5452

A malicious ACAP application can gain access to admin-level service account credentials used by legitimate ACAP applications, leading to potential privilege escalation of the malicious ACAP application. This vulnerability can only be exploited if the Axis device is configured to allow the...

CVE-2025-6298

ACAP applications can gain elevated privileges due to improper input validation, potentially leading to privilege escalation. This vulnerability can only be exploited if the Axis device is configured to allow the installation of unsigned ACAP applications, and if an attacker convinces the victim ...

CVE-2025-6298

CVE-2025-6298 affects Axis devices running ACAP, where improper input validation during ACAP installation can allow elevation of privileges. The issue only applies if the device is configured to permit unsigned ACAP applications and a user installs a malicious ACAP package. The CVSS 3.1 base metr...

CVE-2025-6298

ACAP applications can gain elevated privileges due to improper input validation, potentially leading to privilege escalation. This vulnerability can only be exploited if the Axis device is configured to allow the installation of unsigned ACAP applications, and if an attacker convinces the victim ...

CVE-2025-5718

The ACAP Application framework could allow privilege escalation through a symlink attack. This vulnerability can only be exploited if the Axis device is configured to allow the installation of unsigned ACAP applications, and if an attacker convinces the victim to install a malicious ACAP...

CVE-2025-5718

The ACAP Application framework could allow privilege escalation through a symlink attack. This vulnerability can only be exploited if the Axis device is configured to allow the installation of unsigned ACAP applications, and if an attacker convinces the victim to install a malicious ACAP...

CVE-2025-5718

The CVE-2025-5718 issue concerns the Axis ACAP Application framework on Axis OS devices. It describes a privilege-escalation vulnerability via a symbolic-link (symlink) attack, exploitable only if the device is configured to allow unsigned ACAP applications and an attacker persuades a user to ins...

CVE-2025-5454

Axis ACAP path-traversal vulnerability (CVE-2025-5454) affects Axis OS/ACAP configuration handling on Axis devices. The issue arises from insufficient input validation in ACAP configuration files, enabling potential local path traversal andPrivilege escalation when an Axis device is configured to...

CVE-2025-5454

An ACAP configuration file lacked sufficient input validation, which could allow a path traversal attack leading to potential privilege escalation. This vulnerability can only be exploited if the Axis device is configured to allow the installation of unsigned ACAP applications, and if an attacker...

CVE-2025-5454

An ACAP configuration file lacked sufficient input validation, which could allow a path traversal attack leading to potential privilege escalation. This vulnerability can only be exploited if the Axis device is configured to allow the installation of unsigned ACAP applications, and if an attacker...

CVE-2025-4645

An ACAP configuration file lacked sufficient input validation, which could allow for arbitrary code execution. This vulnerability can only be exploited if the Axis device is configured to allow the installation of unsigned ACAP applications, and if an attacker convinces the victim to install a...

CVE-2025-4645

An ACAP configuration file lacked sufficient input validation, which could allow for arbitrary code execution. This vulnerability can only be exploited if the Axis device is configured to allow the installation of unsigned ACAP applications, and if an attacker convinces the victim to install a...

CVE-2025-4645

CVE-2025-4645 affects Axis OS/Axis ACAP handling: an ACAP configuration file with insufficient input validation can lead to arbitrary code execution if an Axis device is configured to allow unsigned ACAP apps and a victim is persuaded to install a malicious ACAP package. The vulnerability is atta...

PT-2025-46305

Name of the Vulnerable Software and Affected Versions Axis affected versions not specified Description An ACAP configuration file lacked sufficient input validation, which could allow a path traversal attack leading to potential privilege escalation. This issue can only be exploited if the Axis...

PT-2025-46304

Name of the Vulnerable Software and Affected Versions Axis affected versions not specified Description A malicious ACAP application can obtain admin-level service account credentials utilized by legitimate ACAP applications, potentially allowing for privilege escalation of the malicious ACAP...

CVE-2025-5454: Path Traversal: '.../...//'

An ACAP configuration file lacked sufficient input validation, which could allow a path traversal attack leading to potential privilege escalation. This vulnerability can only be exploited if the Axis device is configured to allow the installation of unsigned ACAP applications, and if an attacker...