What is the CVSS score of CVE-2025-0324?

CVE-2025-0324 has a CVSS 3.1 base score of 9.4 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L. EPSS exploitation probability: 0.1%.

Which versions of Axis Os are affected by CVE-2025-0324?

CVE-2025-0324 is a critical privilege escalation vulnerability in Axis VAPIX framework (CVSS 9.4) that allows attackers to gain elevated system privileges on affected Axis devices.. A patch is available.

How to fix or mitigate CVE-2025-0324?

Within 24 hours: Identify all Axis devices running VAPIX framework in your environment using network scanning tools and asset inventory systems. Within 7 days: Contact Axis support or check the Axis security advisory for the specific patch version applicable to your device models and firmware versions, then plan a staged patching schedule. Within 30 days: Deploy vendor-released patches to all identified Axis VAPIX devices, prioritizing internet-facing or mission-critical cameras and encoders first, and verify successful patching through device firmware verification.

Axis Os CVE-2025-0324

EUVD-2025-16622 CRITICAL

Incomplete Filtering of Special Elements (CWE-791)

2025-06-02 product-security@axis.com

Privilege Escalation Axis Os Axis Os 2024 Axis

9.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.4 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

Low

Lifecycle Timeline

Analysis Updated

Apr 16, 2026 - 05:56 EUVD-patch-fix

executive_summary

Re-analysis Queued

Apr 16, 2026 - 05:29 backfill_euvd_patch

patch_released

Patch available

Apr 16, 2026 - 05:29 EUVD

11.11.140,12.3.33

EUVD ID Assigned

Mar 14, 2026 - 16:47 euvd

EUVD-2025-16622

Analysis Generated

Mar 14, 2026 - 16:47 vuln.today

CVE Published

Jun 02, 2025 - 08:15 nvd

CRITICAL 9.4

DescriptionCVE.org

The VAPIX Device Configuration framework allowed a privilege escalation, enabling a lower-privileged user to gain administrator privileges.

AnalysisAI

Privilege escalation in Axis VAPIX framework.

Technical ContextAI

CWE-791.

RemediationAI

Apply firmware update.

More in Axis Os

View all

CVE-2025-0358 HIGH This Week

8.8 Jun 02

Privilege escalation vulnerability in Axis Communications' VAPIX Device Configuration framework that allows a local, aut

CVE-2021-31988 HIGH This Week

8.8 Oct 05

A user controlled parameter related to SMTP test functionality is not correctly validated making it possible to add the

CVE-2025-0359 HIGH This Week

8.5 Mar 04

During an annual penetration test conducted on behalf of Axis Communication, Truesec discovered a flaw in the ACAP Appli

CVE-2023-21415 HIGH This Week

8.1 Oct 16

Sandro Poppi, member of the AXIS OS Bug Bounty Program, has found that the VAPIX API overlay_del.cgi is vulnerable to pa

CVE-2025-0360 HIGH This Week

7.8 Mar 04

During an annual penetration test conducted on behalf of Axis Communication, Truesec discovered a flaw in the VAPIX Devi

CVE-2021-31987 HIGH This Week

7.5 Oct 05

A user controlled parameter related to SMTP test functionality is not correctly validated making it possible to bypass b

CVE-2026-4757 HIGH This Week

7.2 Aug 11

Remote code execution via improper input validation in a VAPIX API parameter on Axis OS affects Axis network camera and

CVE-2023-21413 HIGH This Week

7.2 Oct 16

GoSecure on behalf of Genetec Inc. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attac

CVE-2025-11142 HIGH This Week

7.1 Feb 10

The VAPIX API mediaclip.cgi that did not have a sufficient input validation allowing for a possible remote code executio

CVE-2023-21418 HIGH This Week

7.1 Nov 21

Sandro Poppi, member of the AXIS OS Bug Bounty Program, has found that the VAPIX API irissetup.cgi was vulnerable to pat

CVE-2023-21417 HIGH This Week

7.1 Nov 21

Sandro Poppi, member of the AXIS OS Bug Bounty Program, has found that the VAPIX API manageoverlayimage.cgi was vulnerab

CVE-2023-5553 MEDIUM This Month

6.8 Nov 21

During internal Axis Security Development Model (ASDM) threat-modelling, a flaw was found in the protection for device t

Same weakness CWE-791 – Incomplete Filtering of Special Elements

View all

CVE-2022-2132 HIGH POC

8.6

CVE-2025-2040 MEDIUM POC

5.3

CVE-2025-3841 MEDIUM POC

4.8

8.8

8.7

8.5

8.5

CVE-2024-32162 MEDIUM POC

4.3

Same technique Privilege Escalation

View all

CVE-2024-0012 CRITICAL POC

9.3

CVE-2025-47812 CRITICAL POC

10.0

CVE-2013-0422 CRITICAL POC

9.8

CVE-2013-0632 CRITICAL POC

9.8

CVE-2024-9474 MEDIUM POC

6.9

CVE-2017-5689 CRITICAL POC

9.8

CVE-2021-20021 CRITICAL POC

9.8

CVE-2017-12635 CRITICAL POC

9.8

CVE-2025-0324 vulnerability details – vuln.today

Back

Axis Os CVE-2025-0324

Severity by source

CVSS VectorNVD

Lifecycle Timeline

DescriptionCVE.org

AnalysisAI

Technical ContextAI

RemediationAI

More in Axis Os

Same weakness CWE-791 – Incomplete Filtering of Special Elements

Same technique Privilege Escalation

Share

External POC / Exploit Code