Axis CVE-2025-0358

The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) indicates a high-severity vulnerability with realistic real-world exploitability. Attack Vector Local (AV:L) restricts this to authenticated users with device access; however, Attack Complexity Low (AC:L) and no User Interaction (UI:N) mean exploitation is straightforward once access is gained. The requirement for Privileges Required Low (PR:L) is the primary constraint—an attacker must first compromise or be a low-privileged account. The Scope Change (S:C) with high confidentiality, integrity, and availability impact demonstrates the privilege escalation affects system-wide security. Real-world risk depends on deployment model: in shared-access or compromised-user scenarios, this becomes immediately exploitable. The 8.8 CVSS score correctly reflects the severity, but actual exploitation probability depends on environmental factors (user account compromise likelihood, physical/network access requirements). This is a legitimate priority for organizations with Axis devices in multi-tenant or vulnerable access control environments, particularly where low-privileged accounts exist (e.g., guest accounts, monitoring-only roles).

A realistic attack scenario: An organization deploys Axis network cameras with multi-user access for facility monitoring. A contractor or low-privileged employee gains access to a device (either via network access due to weak segmentation or via physical proximity to a device in a lobby). The attacker authenticates using their assigned low-privilege account (e.g., a 'monitor-only' user role intended only for video viewing). Through the VAPIX Device Configuration API, the attacker exploits the privilege escalation flaw to escalate their account to administrator privileges without user interaction or additional steps. With administrator access, the attacker can: reconfigure device settings, exfiltrate footage, redirect video streams, access or modify stored recordings, compromise the device as a network pivot point, or disable logging to cover their tracks. The local attack vector (AV:L) means the attacker must have some form of access—either network-based (on the same subnet, especially if devices are insufficiently isolated) or physical (direct connection). Low attack complexity means the exploitation is reliable and likely reproducible, making it attractive to both insider threat actors and external attackers who have compromised lower-privileged credentials or network access. The widespread deployment of Axis devices in enterprises amplifies the attack surface if firmware is not promptly patched.