CVE-2026-63286EUVD-2026-111816GHSA-7C4C-2F85-QF36
Database backups are vulnerable to offline attacks.
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 6.20
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
AXIS Camera Station Pro, a video management system, is affected because its database backups can be attacked offline. Backups made before the patched version remain vulnerable, including one backup the software automatically creates during the update, which could expose stored credentials.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
Database backups are vulnerable to offline attacks. Backups created using a version prior to the patched version are still vulnerable. AXIS Camera Station Pro automatically creates one more such backup for recovery purpose when the update is applied. Delete all these backups and change the credentials stored in AXIS Camera Station Pro.
Timeline
- CVE published
- First seen by cve.now
Affected versions
- Axis Communications AB AXIS Camera Station Pro
From 6.0 · fixed in 6.20
- Axis Communications AB AXIS Camera Station 5
From 5.00