Skip to main content

Axis Os 2024 EUVDEUVD-2025-16622

| CVE-2025-0324 CRITICAL
Incomplete Filtering of Special Elements (CWE-791)
2025-06-02 product-security@axis.com
Privilege Escalation Axis Os 2024 Axis Os
9.4
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
9.4 CRITICAL
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
Low

Lifecycle Timeline

6
Analysis Updated
Apr 16, 2026 - 05:56 EUVD-patch-fix
executive_summary
Re-analysis Queued
Apr 16, 2026 - 05:29 backfill_euvd_patch
patch_released
Patch available
Apr 16, 2026 - 05:29 EUVD
11.11.140,12.3.33
EUVD ID Assigned
Mar 14, 2026 - 16:47 euvd
EUVD-2025-16622
Analysis Generated
Mar 14, 2026 - 16:47 vuln.today
CVE Published
Jun 02, 2025 - 08:15 nvd
CRITICAL 9.4

DescriptionCVE.org

The VAPIX Device Configuration framework allowed a privilege escalation, enabling a lower-privileged user to gain administrator privileges.

AnalysisAI

Privilege escalation in Axis VAPIX framework.

Technical ContextAI

CWE-791.

RemediationAI

Apply firmware update.

More in Axis Os 2024

View all
CVE-2025-0359 HIGH
8.5 Mar 04

During an annual penetration test conducted on behalf of Axis Communication, Truesec discovered a flaw in the ACAP Appli
CVE-2025-0360 HIGH
7.8 Mar 04

During an annual penetration test conducted on behalf of Axis Communication, Truesec discovered a flaw in the VAPIX Devi
CVE-2024-6979 HIGH
7.5 Sep 10

Amin Aliakbari, member of the AXIS OS Bug Bounty Program, has found a broken access control which would lead to less-pri
CVE-2024-47261 MEDIUM
4.3 Apr 08

51l3nc3, a member of the AXIS OS Bug Bounty Program, has found that the VAPIX API uploadoverlayimage.cgi did not have su
CVE-2024-47259 LOW
3.5 Mar 04

Girishunawane, member of the AXIS OS Bug Bounty Program, has found that the VAPIX API dynamicoverlay.cgi did not have a

CVE-2024-8160 LOW
2.7 Nov 26

Erik de Jong, member of the AXIS OS Bug Bounty Program, has found that the VAPIX API ftptest.cgi did not have a sufficie
CVE-2025-0361 MEDIUM
4.3 Apr 08

During an annual penetration test conducted on behalf of Axis Communications, Truesec discovered a flaw in the VAPIX Dev

Same weakness CWE-791 – Incomplete Filtering of Special Elements

View all
CVE-2022-2132 HIGH POC
8.6
CVE-2025-2040 MEDIUM POC
5.3
CVE-2025-3841 MEDIUM POC
4.8
CVE-2024-47590 HIGH
8.8
CVE-2026-44232 HIGH
8.7
CVE-2024-45481 HIGH
8.5
CVE-2024-39283 HIGH
8.5
CVE-2024-32162 MEDIUM POC
4.3

Same technique Privilege Escalation

View all
CVE-2025-47812 CRITICAL POC
10.0
CVE-2013-0422 CRITICAL POC
9.8
CVE-2013-0632 CRITICAL POC
9.8
CVE-2017-5689 CRITICAL POC
9.8
CVE-2017-12635 CRITICAL POC
9.8
CVE-2016-10372 CRITICAL POC
9.8
CVE-2014-9583 CRITICAL POC
10.0
CVE-2012-0297 CRITICAL POC
10.0

Share

EUVD-2025-16622 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy