CVE-2025-10714
BaseFortify
Publication date: 2025-11-11
Last updated on: 2025-11-12
Assigner: Axis Communications AB
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| axis | optimizer | 5.5.18.0 |
| axis | optimizer | 5.6.0.0 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-428 | The product uses a search path that contains an unquoted element, in which the element contains whitespace or other separators. This can cause the product to access resources in a parent path. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is an unquoted search path issue in AXIS Optimizer versions 5.5.18.0 and lower. It allows an attacker with local administrator access to write data into the AXIS Optimizer installation directory on a Microsoft Windows system. Exploiting this flaw can lead to privilege escalation, meaning the attacker could gain higher-level system privileges. The vulnerability is classified as CWE-428 and has a high severity rating of 8.4 under CVSSv3.1. A patch fixing this issue is available in AXIS Optimizer version 5.6.0.0 and later. [1]
How can this vulnerability impact me? :
If exploited, this vulnerability can allow an attacker with local administrator rights to escalate their privileges further on a Microsoft Windows system running AXIS Optimizer. This could lead to unauthorized control over system functions or data, potentially compromising system integrity and security. However, exploitation requires specific conditions including local access and write permissions to the installation path. [1]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability involves an unquoted search path in the AXIS Optimizer installation directory on Windows systems. Detection involves checking if the AXIS Optimizer version is 5.5.18.0 or lower and verifying if the installation path contains unquoted spaces that could be exploited. Specific commands are not provided in the resources, but generally, you can check the installation path and version by using Windows commands such as 'wmic product where "name like '%AXIS Optimizer%'" get name, version' to find the installed version, and inspect the installation directory path for unquoted spaces manually or via scripts. [1]
What immediate steps should I take to mitigate this vulnerability?
The immediate mitigation step is to update AXIS Optimizer to version 5.6.0.0 or later, where the unquoted search path vulnerability has been patched. Additionally, ensure that only trusted users have administrator rights and restrict write access to the AXIS Optimizer installation directory to prevent exploitation. [1]