CVE-2025-9055
Unknown Unknown - Not Provided
BaseFortify

Publication date: 2025-11-11

Last updated on: 2025-11-12

Assigner: Axis Communications AB

Description
The VAPIX Edge storage API that allowed a privilege escalation, enabling a VAPIX administrator-privileged user to gain Linux Root privileges. This flaw can only be exploited after authenticating with an administrator-privileged service account.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2025-11-11
Last Modified
2025-11-12
Generated
2026-06-16
AI Q&A
2025-11-11
EPSS Evaluated
2026-06-15
NVD
CVE-2025-9055
Affected Vendors & Products
Showing 3 associated CPEs
Vendor Product Version / Range
axis axis_os 12.7.31
axis axis_os 12.7.30
axis axis_os 12.0.0
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-250 The product performs an operation at a privilege level that is higher than the minimum level required, which creates new weaknesses or amplifies the consequences of other weaknesses.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

CVE-2025-9055 is a vulnerability in the VAPIX Edge storage API of AXIS OS versions 12.0.0 through 12.7.30. It allows a user who already has VAPIX administrator-level privileges to escalate their privileges to gain Linux root access. Exploiting this flaw requires prior authentication with an administrator-privileged service account. The vulnerability is classified as CWE-250: Execution with Unnecessary Privileges and has a CVSSv3.1 score of 6.4 (Medium). [1]

Impact Analysis

This vulnerability can allow an attacker with VAPIX administrator-level access to gain full Linux root privileges on the device, potentially leading to complete control over the system. This could result in unauthorized actions such as modifying system files, installing malicious software, or disrupting device operations. Since exploitation requires prior administrator-level authentication, the risk is limited to users who already have high-level access, but the impact of a successful exploit is significant. [1]

Mitigation Strategies

To mitigate this vulnerability, you should update your Axis device software to AXIS OS version 12.7.31 or later, where the patch addressing this issue has been released. For devices not on the Active Track but still supported, apply patches according to their maintenance schedules. Additionally, contact Axis Technical Support for further assistance if needed. [1]

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2025-9055. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart