Camera Station Pro CVE-2025-30025

CVSS vector analysis shows: AV:L (local only—requires attacker presence on the system), AC:L (low complexity—likely trivial to exploit once on system), PR:L (low privilege required—authenticated user can trigger), UI:N (no user interaction needed), S:U/C:H/I:H/A:H (complete confidentiality, integrity, availability impact). The combination of local attack vector with low complexity and low privilege requirement creates a HIGH real-world risk for multi-tenant systems, shared hosting platforms, and environments where unprivileged users have shell access. Without KEV status, EPSS data, or POC confirmation from the provided data, this appears to be a credible privilege escalation likely exploitable by standard privilege escalation techniques post-compromise. Risk priority depends on deployment context: critical for shared systems, moderate for single-user desktops, high for servers with multiple user accounts.

An unprivileged local user (e.g., webserver daemon, application service account, or compromised standard user) crafts a malicious serialized object targeting the service control protocol. The attacker sends this payload through local IPC (socket/pipe) to the privileged server process. The vulnerable deserialization code deserializes the object without validation, triggering arbitrary code execution in the context of the privileged process. Result: the attacker gains execution as SYSTEM/root, bypassing all application-level security boundaries. This is particularly dangerous in scenarios where: (a) a web application vulnerability gives initial foothold as 'apache' user, then escalates to root via this flaw, (b) a container escape provides local access to host, enabling this escalation, or (c) a remote code execution in any service is amplified to full system compromise. No POC availability noted in provided data; however, CWE-502 deserialization flaws typically have straightforward exploitation once the protocol format is understood.