CVE-2025-0358: Axis OS

High severity, CVSS 8.8. EPSS: 0.2% chance of exploitation in the next 30 days.

During an annual penetration test conducted on behalf of Axis Communication, Truesec discovered a flaw in the VAPIX Device Configuration framework that allowed a privilege escalation, enabling a lower-privileged user to gain administrator privileges.

Affected products

• Axis Axis OS: from 12.0.0, before 12.4.0 (fixed in 12.4.0)

Published 2025-06-02. Last modified 2026-06-17.