Axis Os
CVE-2025-11142
HIGH
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization OS command sanitization, avoid shell exec
MITRE ATT&CK
2 techniques across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | CVSS 7.1 (HIGH). Attack vector: Network. Complexity: Low. Privileges required: Low. User interaction: None. Exploitation requires authentication. Exploitable via remote/network. |
| Exploit ScenarioDerived | A remote attacker (requires authentication) could exploit this vulnerability to compromise the affected system. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 12, 2026
The VAPIX API mediaclip.cgi that did not have a sufficient input validation allowing for a possible remote code execution. This flaw can only be exploited after authenticating with an operator- or administrator- privileged service account. [CVSS 7.1 HIGH]
RemediationAI
Monitor vendor advisories for a patch. Restrict network access to the affected service where possible.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Classified as CWE-78 (OS Command Injection). Affects Axis Os. The VAPIX API mediaclip.cgi that did not have a sufficient input validation allowing for a possible remote code execution. This flaw can only be exploited after authenticating with an operator- or administrator- privileged service account.
Know when Axis Os gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
DescriptionCVE.org
The VAPIX API mediaclip.cgi that did not have a sufficient input validation allowing for a possible remote code execution. This flaw can only be exploited after authenticating with an operator- or administrator- privileged service account.
Executive ViewAI
CVE-2025-11142 affects Axis VAPIX API and allows authenticated users with operator or administrator privileges to execute arbitrary code on affected devices. Organizations running Axis network cameras or video management systems should prioritize identifying and protecting these assets, as successful exploitation could compromise surveillance infrastructure and potentially provide attackers with network access.
Disable mediaclip.cgi service if not required for operations; implement network access controls to restrict API access to trusted IP ranges only; enforce principle of least privilege for operator and administrator accounts; deploy WAF rules to block suspicious mediaclip.cgi requests; enable comprehensive audit logging for all API access; segregate video management systems on dedicated VLANs with strict egress filtering; monitor for suspicious authentication patterns and code execution indicators.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Affected Products (CPE)CVE.org
Privilege escalation in Axis VAPIX framework.
Privilege escalation vulnerability in Axis Communications' VAPIX Device Configuration framework that allows a local, aut
Code execution with potential privilege escalation in AXIS OS 12.0.0 through 12.10.35 is reachable only after an attacke
A user controlled parameter related to SMTP test functionality is not correctly validated making it possible to add the
During an annual penetration test conducted on behalf of Axis Communication, Truesec discovered a flaw in the ACAP Appli
Sandro Poppi, member of the AXIS OS Bug Bounty Program, has found that the VAPIX API overlay_del.cgi is vulnerable to pa
During an annual penetration test conducted on behalf of Axis Communication, Truesec discovered a flaw in the VAPIX Devi
A user controlled parameter related to SMTP test functionality is not correctly validated making it possible to bypass b
Command injection in the ACAP configuration-file handling of AXIS OS 12.x allows a local, authenticated attacker to esca
Path traversal in AXIS OS handling of ACAP application configuration files gives a local attacker holding low-level priv
Privilege escalation on Axis devices running AXIS OS 12.0.0 through 12.9.31 lets a malicious ACAP (Axis Camera Applicati
Remote code execution via improper input validation in a VAPIX API parameter on Axis OS affects Axis network camera and
GitHub PoC
Exploit-DB