CVE-2025-3892
BaseFortify
Publication date: 2025-08-12
Last updated on: 2025-08-12
Assigner: Axis Communications AB
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| axis | axis_os | 12.0.0 |
| axis | axis_os | 12.5.31 |
| axis | axis_os | 12.5.30 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-250 | The product performs an operation at a privilege level that is higher than the minimum level required, which creates new weaknesses or amplifies the consequences of other weaknesses. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability involves ACAP applications on Axis devices being executed with elevated privileges, which can lead to privilege escalation. It can only be exploited if the device is configured to allow installation of unsigned ACAP applications and if an attacker convinces a user to install a malicious ACAP application.
How can this vulnerability impact me? :
If exploited, this vulnerability can allow an attacker to gain higher privileges on the Axis device, potentially leading to unauthorized access, control, or disruption of the device's functions.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, ensure that the Axis device is not configured to allow the installation of unsigned ACAP applications. Avoid installing ACAP applications from untrusted sources to prevent potential privilege escalation.