Axis Communications AB vulnerabilities
100 CVEs and advisories name Axis Communications AB as an affected vendor, newest first. Follow it as a feed.
- CVE-2025-11142The VAPIX API mediaclip.cgi that did not have a sufficient input validation allowing for a possible remote code execution.
- CVE-2025-9055The VAPIX Edge storage API that allowed a privilege escalation, enabling a VAPIX administrator-privileged user to gain Linux Root privileges
- CVE-2025-8998It was possible to upload files with a specific name to a temporary directory, which may result in process crashes and impact usability.
- CVE-2025-9524The VAPIX API port.cgi did not have sufficient input validation, which may result in process crashes and impact usability.
- CVE-2025-10714AXIS Optimizer was vulnerable to an unquoted search path vulnerability, which could potentially lead to privilege escalation within Microsof
- CVE-2025-8108An ACAP configuration file has improper permissions and lacks input validation, which could potentially lead to privilege escalation.
- CVE-2025-6779An ACAP configuration file has improper permissions, which could allow command injection and potentially lead to privilege escalation.
- CVE-2025-6571A 3rd-party component exposed its password in process arguments, allowing for low-privileged users to access it.
- CVE-2025-5452A malicious ACAP application can gain access to admin-level service account credentials used by legitimate ACAP applications, leading to pot
- CVE-2025-6298ACAP applications can gain elevated privileges due to improper input validation, potentially leading to privilege escalation.
- CVE-2025-5718The ACAP Application framework could allow privilege escalation through a symlink attack.
- CVE-2025-5454An ACAP configuration file lacked sufficient input validation, which could allow a path traversal attack leading to potential privilege esca
- CVE-2025-4645An ACAP configuration file lacked sufficient input validation, which could allow for arbitrary code execution.
- CVE-2025-30027An ACAP configuration file lacked sufficient input validation, which could allow for arbitrary code execution.
- CVE-2025-3892ACAP applications can be executed with elevated privileges, potentially leading to privilege escalation.
- CVE-2025-7622During an internal security assessment, a Server-Side Request Forgery (SSRF) vulnerability that allowed an authenticated attacker to access
- CVE-2025-30026The AXIS Camera Station Server had a flaw that allowed to bypass authentication that is normally required.
- CVE-2025-30025The communication protocol used between the server process and the service control had a flaw that could lead to a local privilege escalatio
- CVE-2025-30024The communication protocol used between client and server had a flaw that could be leveraged to execute a man in the middle attack.
- CVE-2025-30023The communication protocol used between client and server had a flaw that could lead to an authenticated user performing a remote code execu
- CVE-2025-0358During an annual penetration test conducted on behalf of Axis Communication, Truesec discovered a flaw in the VAPIX Device Configuration fra
- CVE-2025-0325A Guard Tour VAPIX API parameter allowed the use of arbitrary values and can be incorrectly called, allowing an attacker to block access to
- CVE-2025-0324The VAPIX Device Configuration framework allowed a privilege escalation, enabling a lower-privileged user to gain administrator privileges.
- CVE-2025-0926Gee-netics, member of AXIS Camera Station Pro Bug Bounty Program, has found that it is possible for a non-admin user to remove system files
- CVE-2025-1056Gee-netics, member of AXIS Camera Station Pro Bug Bounty Program, has identified an issue with a specific file that the server is using.
- CVE-2025-0361During an annual penetration test conducted on behalf of Axis Communications, Truesec discovered a flaw in the VAPIX Device Configuration fr
- CVE-2024-4726151l3nc3, a member of the AXIS OS Bug Bounty Program, has found that the VAPIX API uploadoverlayimage.cgi did not have sufficient input valid
- CVE-2025-0360During an annual penetration test conducted on behalf of Axis Communication, Truesec discovered a flaw in the VAPIX Device Configuration fra
- CVE-2025-0359During an annual penetration test conducted on behalf of Axis Communication, Truesec discovered a flaw in the ACAP Application framework tha
- CVE-2024-47262Dzmitry Lukyanenka, member of the AXIS OS Bug Bounty Program, has found that the VAPIX API param.cgi was vulnerable to a race condition atta