What is the CVSS score of CVE-2025-0358?

CVE-2025-0358 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Axis Os are affected by CVE-2025-0358?

CVE-2025-0358 is a privilege escalation vulnerability in Axis Communications' VAPIX Device Configuration framework that allows authenticated local users to gain administrator-level access to network…. A patch is available.

How to fix or mitigate CVE-2025-0358?

Within 24 hours: Inventory all Axis devices using VAPIX framework and identify current firmware versions. Within 7 days: Apply vendor-released patch to all affected Axis devices in test environments first, then production. Within 30 days: Complete patching of all Axis devices; audit administrative access logs for unauthorized privilege escalation attempts; review device placement and access controls to limit local access to trusted personnel only.

Axis Os CVE-2025-0358

EUVD-2025-16620 HIGH

Improper Privilege Management (CWE-269)

2025-06-02 product-security@axis.com

Privilege Escalation Axis Os

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Apr 16, 2026 - 06:45 EUVD-patch-fix

executive_summary

Re-analysis Queued

Apr 16, 2026 - 05:29 backfill_euvd_patch

patch_released

Patch available

Apr 16, 2026 - 05:29 EUVD

12.4.0

EUVD ID Assigned

Mar 14, 2026 - 16:47 euvd

EUVD-2025-16620

Analysis Generated

Mar 14, 2026 - 16:47 vuln.today

CVE Published

Jun 02, 2025 - 08:15 nvd

HIGH 8.8

DescriptionCVE.org

During an annual penetration test conducted on behalf of Axis Communication, Truesec discovered a flaw in the VAPIX Device Configuration framework that allowed a privilege escalation, enabling a lower-privileged user to gain administrator privileges.

AnalysisAI

Privilege escalation vulnerability in Axis Communications' VAPIX Device Configuration framework that allows a local, authenticated user with lower privileges to escalate to administrator-level access. Discovered during a penetration test by Truesec, this flaw affects Axis network devices and cameras utilizing the vulnerable VAPIX framework. With a CVSS score of 8.8 and local attack vector, the vulnerability poses significant risk to organizations deploying Axis devices in multi-user or untrusted environments, though it requires prior authentication and local access to exploit.

Technical ContextAI

VAPIX (Versatile Application Program Interface for Axis devices) is Axis Communications' proprietary API framework used for device configuration and management across their network camera and appliance product lines. The vulnerability resides in the Device Configuration component of this framework and is classified under CWE-269 (Improper Access Control), indicating insufficient validation or enforcement of privilege boundaries within the configuration module. The flaw allows a principal with lower privilege level (PR:L) to perform actions restricted to administrator roles through the VAPIX interface, suggesting insufficient authorization checks or privilege boundary enforcement in the API logic. Affected CPE identifiers would include products such as Axis network cameras (AXIS P series, AXIS Q series) and video management appliances that implement VAPIX configuration services, though specific version ranges require vendor advisories for precise identification.

RemediationAI

Immediate remediation requires patching Axis device firmware to versions that address the VAPIX Device Configuration privilege escalation. Specific remediation steps: (1) Identify all Axis devices in the environment and their current firmware versions; (2) Consult Axis Communications security advisories and release notes for patched firmware versions addressing CVE-2025-0358; (3) Plan and execute firmware updates following Axis's recommended upgrade procedures (typically via device management interface or centralized management tools); (4) Test patched devices in non-production environments first to ensure compatibility. Interim mitigations pending patching: (a) Restrict local/network access to VAPIX configuration interfaces to authorized administrative users only; (b) Disable remote VAPIX configuration if not required; (c) Implement strong authentication and access controls for any accounts with device access; (d) Monitor for unauthorized configuration changes through device audit logs; (e) Segment Axis devices on dedicated VLANs with restricted access policies. Workarounds are limited due to the authentication requirement; prevention of unauthorized local/network access to devices is the primary interim control. Axis Communications' official advisories and patches should be sourced from their security portal or direct communication with their support team.