CVE-2025-8998
BaseFortify
Publication date: 2025-11-11
Last updated on: 2025-11-12
Assigner: Axis Communications AB
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| axis | axis_os | 10.12.306 |
| axis | axis_os | 11.11.178 |
| axis | axis_os | 8.40.90 |
| axis | axis_os | 12.7 |
| axis | axis_os | 9.80.124 |
| axis | axis_os | 6.50 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-73 | The product allows user input to control or influence paths or file names that are used in filesystem operations. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2025-8998 is a vulnerability in AXIS OS versions 6.50 through 12.7 that allows authenticated users with operator or administrator privileges to upload files with specific names to a temporary directory. This can cause process crashes and impact the usability of the device. The issue is related to external control of file names or paths (CWE-73) and has a low severity score of 3.1. [1]
How can this vulnerability impact me? :
If exploited by an authenticated operator or administrator, this vulnerability can cause process crashes on the device, which may impact its usability. However, it does not affect confidentiality or integrity, only availability to a limited extent, and no public exploits are known. [1]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability involves uploading files with specific names to a temporary directory by authenticated users with operator or administrator privileges. Detection would involve monitoring for such file uploads or attempts to upload files with suspicious or specific names to temporary directories on AXIS OS devices. However, no specific detection commands or tools are provided in the available resources. [1]
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, update your AXIS OS devices to the latest patched versions provided by Axis, such as Active Track 12.7.27, LTS 2024 11.11.178, LTS 2022 10.12.306, LTS 2020 9.80.124, or former LTS versions 8.40.90 and 6.50.5.22 if still under software support. Follow your maintenance schedules to apply these updates. Additionally, restrict operator- or administrator-privileged accounts to trusted users only and monitor for unauthorized file uploads to temporary directories. Contact Axis Technical Support for further assistance if needed. [1]