AXIS Camera Station CVE-2026-63286

The attacker must obtain an AXIS Camera Station Pro / Camera Station 5 database backup file and perform an offline attack against its inadequately strong encryption (CWE-326) to recover the credentials stored inside; per the advisory this includes backups created before patching AND the one additional recovery backup that Camera Station automatically generates when the update is applied, both of which remain vulnerable. Limiting factors consistent with the CVSS vector: exploitation requires local access to the backup artifacts (AV:L) and low-level privileges (PR:L), with no user interaction (UI:N) - it is not remotely exploitable against a default network-facing service. The vendor states remediation requires deleting all such backups and changing the credentials stored in AXIS Camera Station Pro, in addition to updating; updating alone does not remove already-exposed backups.

The input CVSS vector (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N, 7.1 High) is the dominant signal and it describes a locally-exploitable, low-privilege weakness rather than a remotely-reachable one: AV:L means the attacker must already have local access to the backup artifacts, and PR:L means some level of authenticated/low privilege is required, so this is not a mass-exploitable internet-facing flaw. No KEV listing, no EPSS score, and no PoC are present in the supplied data, so exploitation probability signals are absent rather than low - this is missing data, not evidence of safety. The vuln.today Decision label is 'this_week', indicating moderate prioritization consistent with a high-impact-but-access-gated issue rather than an emergency. The distinctive risk amplifier, confirmed by the Axis advisory, is operational: backups made before the patch stay vulnerable, and applying the update itself writes one additional vulnerable backup, so simply patching does NOT close the exposure - stored credentials remain recoverable from any lingering backup until those backups are deleted and credentials rotated. Net: a credible high-confidentiality/integrity issue for environments where backup files are accessible to untrusted or low-privileged parties, but gated by local access rather than a widespread remote threat.

A low-privileged user on the host, or anyone with read access to backup storage/media, copies an AXIS Camera Station database backup offline and defeats its inadequately strong encryption (CWE-326) to extract stored credentials, including the extra recovery backup the update automatically creates. Consistent with AV:L/AC:L/PR:L, no user interaction is needed and the cracking is performed offline at the attacker's leisure. No public exploit identified at time of analysis.