Summary
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Axis Camera Station und Axis Device Manager ausnutzen, um die Authentifizierung zu umgehen, erhöhte Privilegien zu erlangen, eine Man-in-the-Middle-Attacke durchzuführen und beliebigen Code auszuführen.
Product
Axis Camera Station ist eine Videoüberwachungssoftware zur Aufzeichnung und Verwaltung von Videostreams von Netzwerkkameras.
Axis Device Manager ist eine Softwareanwendung zur zentralen Verwaltung von Axis Netzwerkgeräten wie Kameras und Encodern.
Vulnerabilities 4
-
Critical 9.0
The communication protocol used between client and server had a flaw that could lead to an authenticated user performin…
-
Medium 6.8
The communication protocol used between client and server had a flaw that could be leveraged to execute a man in the mi…
-
Medium 5.3
The AXIS Camera Station Server had a flaw that allowed to bypass authentication that is normally required.
-
Medium 4.8
The communication protocol used between the server process and the service control had a flaw that could lead to a loca…
Revision history
-
#2
PoC aufgenommen CVE-2025-30026 + CVE-2025-30023
-
#1
Initiale Fassung
References
-
Team82 Report vom 2025-08-11
https://claroty.com/team82/research/turning-camera-surveillance-on-its-axis
-
Axis Security Advisory vom 2025-08-11
https://www.axis.com/dam/public/9b/a5/72/cve-2025-30023pdf-en-US-485733.pdf
-
Axis Security Advisory vom 2025-08-11
https://www.axis.com/dam/public/01/d9/24/cve-2025-30024pdf-en-US-485734.pdf
-
Axis Security Advisory vom 2025-08-11
https://www.axis.com/dam/public/40/0e/03/cve-2025-30025pdf-en-US-485736.pdf
-
Axis Security Advisory vom 2025-08-11
https://www.axis.com/dam/public/a3/42/92/cve-2025-30026pdf-en-US-485735.pdf
-
PoC CVE-2025-30026 + CVE-2025-30023
https://ricardojoserf.github.io/axisrce/