Vulnerability-Lookup

CVE-2025-9524 (GCVE-0-2025-9524)

Vulnerability from cvelistv5 – Published: 2025-11-11 07:25 – Updated: 2025-11-14 17:54

Summary

The VAPIX API port.cgi did not have sufficient input validation, which may result in process crashes and impact usability. This vulnerability can only be exploited after authenticating with a viewer- operator- or administrator-privileged service account.

Severity

4.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-11-14 17:54 UTC

CWE

CWE-1287 - Improper Validation of Specified Type of Input

Assigner

Axis CNA under the mitre root

CNA scorecard D 59/100 over 10 records in the last 180 days details

References

1 reference

URL	Tags
https://www.axis.com/dam/public/f1/f0/1e/cve-2025…

Impacted products

1 product

Vendor	Product	Version	CPE status
Axis Communications AB	AXIS OS	Affected: 6.50.0 , < 6.50.5.21 (semver) Affected: 7.0.0 , < 8.40.89 (semver) Affected: 9.0.0 , < 9.80.123 (semver) Affected: 10.0.0 , < 10.12.305 (semver) Affected: 11.0.0 , < 11.11.177 (semver) Affected: 12.0.0 , < 12.7.11 (semver) cpe:2.3:a:axis_communications_ab:axis_os:::::::: cpe:2.3:a:axis_communications_ab:axis_os:::::::: cpe:2.3:a:axis_communications_ab:axis_os:::::::: cpe:2.3:a:axis_communications_ab:axis_os:::::::: cpe:2.3:a:axis_communications_ab:axis_os:::::::: cpe:2.3:a:axis_communications_ab:axis_os::::::::

Credits

Mucoze

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-9524",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-11-14T17:54:12.194729Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-11-14T17:54:18.966Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "AXIS OS",
          "vendor": "Axis Communications AB",
          "versions": [
            {
              "lessThan": "6.50.5.21",
              "status": "affected",
              "version": "6.50.0",
              "versionType": "semver"
            },
            {
              "lessThan": "8.40.89",
              "status": "affected",
              "version": "7.0.0",
              "versionType": "semver"
            },
            {
              "lessThan": "9.80.123",
              "status": "affected",
              "version": "9.0.0",
              "versionType": "semver"
            },
            {
              "lessThan": "10.12.305",
              "status": "affected",
              "version": "10.0.0",
              "versionType": "semver"
            },
            {
              "lessThan": "11.11.177",
              "status": "affected",
              "version": "11.0.0",
              "versionType": "semver"
            },
            {
              "lessThan": "12.7.11",
              "status": "affected",
              "version": "12.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:axis_communications_ab:axis_os:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.50.5.21",
                  "versionStartIncluding": "6.50.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:axis_communications_ab:axis_os:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "8.40.89",
                  "versionStartIncluding": "7.0.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:axis_communications_ab:axis_os:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "9.80.123",
                  "versionStartIncluding": "9.0.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:axis_communications_ab:axis_os:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "10.12.305",
                  "versionStartIncluding": "10.0.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:axis_communications_ab:axis_os:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "11.11.177",
                  "versionStartIncluding": "11.0.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:axis_communications_ab:axis_os:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "12.7.11",
                  "versionStartIncluding": "12.0.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ],
          "operator": "OR"
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Mucoze"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "The VAPIX API \u003ci\u003eport.cgi\u003c/i\u003e did not have sufficient input validation, which may result in process crashes and impact usability. This vulnerability can only be exploited after authenticating with a viewer- operator- or administrator-privileged service account."
            }
          ],
          "value": "The VAPIX API port.cgi did not have sufficient input validation, which may result in process crashes and impact usability. This vulnerability can only be exploited after authenticating with a viewer- operator- or administrator-privileged service account."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-1287",
              "description": "CWE-1287: Improper Validation of Specified Type of Input",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-11-11T07:33:54.758Z",
        "orgId": "f2daf9a0-02c2-4b83-a01d-63b3b304b807",
        "shortName": "Axis"
      },
      "references": [
        {
          "url": "https://www.axis.com/dam/public/f1/f0/1e/cve-2025-9524pdf-en-US-504220.pdf"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "x_generator": {
        "engine": "Vulnogram 0.5.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f2daf9a0-02c2-4b83-a01d-63b3b304b807",
    "assignerShortName": "Axis",
    "cveId": "CVE-2025-9524",
    "datePublished": "2025-11-11T07:25:45.754Z",
    "dateReserved": "2025-08-27T05:23:55.357Z",
    "dateUpdated": "2025-11-14T17:54:18.966Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-9524",
      "date": "2026-10-21",
      "epss": "0.0027",
      "percentile": "0.18155"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "AXIS OS",
                "vendor": "Axis Communications AB",
                "versions": [
                  {
                    "lessThan": "6.50.5.21",
                    "status": "affected",
                    "version": "6.50.0",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "8.40.89",
                    "status": "affected",
                    "version": "7.0.0",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "9.80.123",
                    "status": "affected",
                    "version": "9.0.0",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "10.12.305",
                    "status": "affected",
                    "version": "10.0.0",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "11.11.177",
                    "status": "affected",
                    "version": "11.0.0",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "12.7.11",
                    "status": "affected",
                    "version": "12.0.0",
                    "versionType": "semver"
                  }
                ]
              }
            ],
            "source": "product-security@axis.com"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "The VAPIX API port.cgi did not have sufficient input validation, which may result in process crashes and impact usability. This vulnerability can only be exploited after authenticating with a viewer- operator- or administrator-privileged service account."
          },
          {
            "lang": "es",
            "value": "El puerto .cgi de la API VAPIX no ten\u00eda suficiente validaci\u00f3n de entrada, lo que podr\u00eda resultar en ca\u00eddas de procesos y tener un impacto en la usabilidad. Esta vulnerabilidad solo puede ser explotada despu\u00e9s de autenticarse con una cuenta de servicio con privilegios de visualizador, operador o administrador."
          }
        ],
        "id": "CVE-2025-9524",
        "lastModified": "2026-10-18T21:10:00.120",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "LOW",
                "baseScore": 4.3,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L",
                "version": "3.1"
              },
              "exploitabilityScore": 2.8,
              "impactScore": 1.4,
              "source": "product-security@axis.com",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2025-9524",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-11-14T17:54:12.194729Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2025-11-11T08:15:35.213",
        "references": [
          {
            "source": "product-security@axis.com",
            "url": "https://www.axis.com/dam/public/f1/f0/1e/cve-2025-9524pdf-en-US-504220.pdf"
          }
        ],
        "sourceIdentifier": "product-security@axis.com",
        "vulnStatus": "Deferred",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-1287"
              }
            ],
            "source": "product-security@axis.com",
            "type": "Secondary"
          }
        ]
      }
    },
    "redhat_vex": {
      "current_release_date": "2025-11-12T07:47:36+00:00",
      "cve": "CVE-2025-9524",
      "id": "CVE-2025-9524",
      "initial_release_date": "2025-01-01T00:00:00+00:00",
      "product_status:known_not_affected": "1",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "CVE-2025-9524",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-9524.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2025-9524",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2025-11-14T17:54:12.194729Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2025-11-14T17:54:15.571Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "product": "AXIS OS",
              "vendor": "Axis Communications AB",
              "versions": [
                {
                  "lessThan": "6.50.5.21",
                  "status": "affected",
                  "version": "6.50.0",
                  "versionType": "semver"
                },
                {
                  "lessThan": "8.40.89",
                  "status": "affected",
                  "version": "7.0.0",
                  "versionType": "semver"
                },
                {
                  "lessThan": "9.80.123",
                  "status": "affected",
                  "version": "9.0.0",
                  "versionType": "semver"
                },
                {
                  "lessThan": "10.12.305",
                  "status": "affected",
                  "version": "10.0.0",
                  "versionType": "semver"
                },
                {
                  "lessThan": "11.11.177",
                  "status": "affected",
                  "version": "11.0.0",
                  "versionType": "semver"
                },
                {
                  "lessThan": "12.7.11",
                  "status": "affected",
                  "version": "12.0.0",
                  "versionType": "semver"
                }
              ]
            }
          ],
          "cpeApplicability": [
            {
              "nodes": [
                {
                  "cpeMatch": [
                    {
                      "criteria": "cpe:2.3:a:axis_communications_ab:axis_os:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "6.50.5.21",
                      "versionStartIncluding": "6.50.0",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:a:axis_communications_ab:axis_os:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "8.40.89",
                      "versionStartIncluding": "7.0.0",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:a:axis_communications_ab:axis_os:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "9.80.123",
                      "versionStartIncluding": "9.0.0",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:a:axis_communications_ab:axis_os:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "10.12.305",
                      "versionStartIncluding": "10.0.0",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:a:axis_communications_ab:axis_os:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "11.11.177",
                      "versionStartIncluding": "11.0.0",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:a:axis_communications_ab:axis_os:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "12.7.11",
                      "versionStartIncluding": "12.0.0",
                      "vulnerable": true
                    }
                  ],
                  "negate": false,
                  "operator": "OR"
                }
              ],
              "operator": "OR"
            }
          ],
          "credits": [
            {
              "lang": "en",
              "type": "finder",
              "value": "Mucoze"
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "supportingMedia": [
                {
                  "base64": false,
                  "type": "text/html",
                  "value": "The VAPIX API \u003ci\u003eport.cgi\u003c/i\u003e did not have sufficient input validation, which may result in process crashes and impact usability. This vulnerability can only be exploited after authenticating with a viewer- operator- or administrator-privileged service account."
                }
              ],
              "value": "The VAPIX API port.cgi did not have sufficient input validation, which may result in process crashes and impact usability. This vulnerability can only be exploited after authenticating with a viewer- operator- or administrator-privileged service account."
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "LOW",
                "baseScore": 4.3,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L",
                "version": "3.1"
              },
              "format": "CVSS",
              "scenarios": [
                {
                  "lang": "en",
                  "value": "GENERAL"
                }
              ]
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-1287",
                  "description": "CWE-1287: Improper Validation of Specified Type of Input",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2025-11-11T07:33:54.758Z",
            "orgId": "f2daf9a0-02c2-4b83-a01d-63b3b304b807",
            "shortName": "Axis"
          },
          "references": [
            {
              "url": "https://www.axis.com/dam/public/f1/f0/1e/cve-2025-9524pdf-en-US-504220.pdf"
            }
          ],
          "source": {
            "discovery": "UNKNOWN"
          },
          "x_generator": {
            "engine": "Vulnogram 0.5.0"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "f2daf9a0-02c2-4b83-a01d-63b3b304b807",
        "assignerShortName": "Axis",
        "cveId": "CVE-2025-9524",
        "datePublished": "2025-11-11T07:25:45.754Z",
        "dateReserved": "2025-08-27T05:23:55.357Z",
        "dateUpdated": "2025-11-14T17:54:18.966Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

CERTFR-2025-AVI-0951

Vulnerability from certfr_avis - Published: 2025-11-03 - Updated: 2025-11-03

De multiples vulnérabilités ont été découvertes dans Axis OS. Elles permettent à un attaquant de provoquer un problème de sécurité non spécifié par l'éditeur.

Solutions

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

Impacted products

	Vendor	Product	Description
	Axis	Axis OS	Axis OS versions 12.x antérieures à 12.7

References

Title

Publication Time

Tags

Bulletin de sécurité Axis

2025-11-03

vendor-advisory

Show details on source website

JSON

To clipboard

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Axis OS versions 12.x ant\u00e9rieures \u00e0 12.7",
      "product": {
        "name": "Axis OS",
        "vendor": {
          "name": "Axis",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": "",
  "content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
  "cves": [
    {
      "name": "CVE-2025-8108",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-8108"
    },
    {
      "name": "CVE-2025-8998",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-8998"
    },
    {
      "name": "CVE-2025-9524",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-9524"
    },
    {
      "name": "CVE-2025-9055",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-9055"
    },
    {
      "name": "CVE-2025-11142",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-11142"
    }
  ],
  "initial_release_date": "2025-11-03T00:00:00",
  "last_revision_date": "2025-11-03T00:00:00",
  "links": [],
  "reference": "CERTFR-2025-AVI-0951",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2025-11-03T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Non sp\u00e9cifi\u00e9 par l\u0027\u00e9diteur"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans Axis OS. Elles permettent \u00e0 un attaquant de provoquer un probl\u00e8me de s\u00e9curit\u00e9 non sp\u00e9cifi\u00e9 par l\u0027\u00e9diteur.",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans Axis OS",
  "vendor_advisories": [
    {
      "published_at": "2025-11-03",
      "title": "Bulletin de s\u00e9curit\u00e9 Axis",
      "url": "https://help.axis.com/en-us/axis-os-release-notes#axis-os-12"
    }
  ]
}

CERTFR-2025-AVI-0985

Vulnerability from certfr_avis - Published: 2025-11-12 - Updated: 2025-11-12

De multiples vulnérabilités ont été découvertes dans les produits Axis. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, une élévation de privilèges et un déni de service à distance.

Solutions

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

Impacted products

Vendor	Product	Description
Axis	Axis OS	Axis OS (anciennement LTS) versions 6.x antérieures à 6.50.5.22
Axis	Optimizer	Axis Optimizer versions antérieures à 5.6.0.0
Axis	Axis OS	Axis OS LTS 2024 versions 11.x antérieures à 11.11.178
Axis	Axis OS	Axis OS LTS 2022 versions 10.x antérieures à 10.12.306
Axis	Axis OS	Axis OS (anciennement LTS) versions 8.x antérieures à 8.40.90
Axis	Axis OS	Axis OS LTS 2020 versions 9.x antérieures à 9.80.124
Axis	Axis OS	Axis OS Active Track versions 12.x antérieures à 12.7.33

References

Title

Publication Time

Tags

Bulletin de sécurité Axis cve-2025-10714pdf-en-US-504221	2025-11-11	vendor-advisory
Bulletin de sécurité Axis cve-2025-9524pdf-en-US-504220	2025-11-11	vendor-advisory
Bulletin de sécurité Axis cve-2025-8998pdf-en-US-504374	2025-11-11	vendor-advisory
Bulletin de sécurité Axis cve-2025-6779pdf-en-US-504217	2025-11-11	vendor-advisory
Bulletin de sécurité Axis cve-2025-4645pdf-en-US-504211	2025-11-11	vendor-advisory
Bulletin de sécurité Axis cve-2025-9055pdf-en-US-504219	2025-11-11	vendor-advisory
Bulletin de sécurité Axis cve-2025-6298pdf-en-US-504215	2025-11-11	vendor-advisory
Bulletin de sécurité Axis cve-2025-5718pdf-en-US-504214	2025-11-11	vendor-advisory
Bulletin de sécurité Axis cve-2025-5454pdf-en-US-504213	2025-11-11	vendor-advisory
Bulletin de sécurité Axis cve-2025-8108pdf-en-US-504218	2025-11-11	vendor-advisory
Bulletin de sécurité Axis cve-2025-5452pdf-en-US-504212	2025-11-11	vendor-advisory
Bulletin de sécurité Axis cve-2025-6571pdf-en-US-504216	2025-11-11	vendor-advisory

Show details on source website

JSON

To clipboard

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Axis OS (anciennement LTS) versions 6.x ant\u00e9rieures \u00e0 6.50.5.22",
      "product": {
        "name": "Axis OS",
        "vendor": {
          "name": "Axis",
          "scada": false
        }
      }
    },
    {
      "description": "Axis Optimizer versions ant\u00e9rieures \u00e0 5.6.0.0",
      "product": {
        "name": "Optimizer",
        "vendor": {
          "name": "Axis",
          "scada": false
        }
      }
    },
    {
      "description": "Axis OS LTS 2024 versions 11.x ant\u00e9rieures \u00e0 11.11.178",
      "product": {
        "name": "Axis OS",
        "vendor": {
          "name": "Axis",
          "scada": false
        }
      }
    },
    {
      "description": "Axis OS LTS 2022 versions 10.x ant\u00e9rieures \u00e0 10.12.306",
      "product": {
        "name": "Axis OS",
        "vendor": {
          "name": "Axis",
          "scada": false
        }
      }
    },
    {
      "description": "Axis OS (anciennement LTS) versions 8.x ant\u00e9rieures \u00e0 8.40.90",
      "product": {
        "name": "Axis OS",
        "vendor": {
          "name": "Axis",
          "scada": false
        }
      }
    },
    {
      "description": "Axis OS LTS 2020 versions 9.x ant\u00e9rieures \u00e0 9.80.124",
      "product": {
        "name": "Axis OS",
        "vendor": {
          "name": "Axis",
          "scada": false
        }
      }
    },
    {
      "description": "Axis OS Active Track versions 12.x ant\u00e9rieures \u00e0 12.7.33",
      "product": {
        "name": "Axis OS",
        "vendor": {
          "name": "Axis",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": "",
  "content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
  "cves": [
    {
      "name": "CVE-2025-5718",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-5718"
    },
    {
      "name": "CVE-2025-8108",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-8108"
    },
    {
      "name": "CVE-2025-8998",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-8998"
    },
    {
      "name": "CVE-2025-6571",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-6571"
    },
    {
      "name": "CVE-2025-4645",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-4645"
    },
    {
      "name": "CVE-2025-9524",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-9524"
    },
    {
      "name": "CVE-2025-5454",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-5454"
    },
    {
      "name": "CVE-2025-9055",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-9055"
    },
    {
      "name": "CVE-2025-5452",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-5452"
    },
    {
      "name": "CVE-2025-10714",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-10714"
    },
    {
      "name": "CVE-2025-6298",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-6298"
    },
    {
      "name": "CVE-2025-6779",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-6779"
    }
  ],
  "initial_release_date": "2025-11-12T00:00:00",
  "last_revision_date": "2025-11-12T00:00:00",
  "links": [],
  "reference": "CERTFR-2025-AVI-0985",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2025-11-12T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "D\u00e9ni de service \u00e0 distance"
    },
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    },
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    },
    {
      "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
    },
    {
      "description": "\u00c9l\u00e9vation de privil\u00e8ges"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits Axis. Certaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer une ex\u00e9cution de code arbitraire \u00e0 distance, une \u00e9l\u00e9vation de privil\u00e8ges et un d\u00e9ni de service \u00e0 distance.",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits Axis",
  "vendor_advisories": [
    {
      "published_at": "2025-11-11",
      "title": "Bulletin de s\u00e9curit\u00e9 Axis cve-2025-10714pdf-en-US-504221",
      "url": "https://www.axis.com/dam/public/a2/c7/8c/cve-2025-10714pdf-en-US-504221.pdf"
    },
    {
      "published_at": "2025-11-11",
      "title": "Bulletin de s\u00e9curit\u00e9 Axis cve-2025-9524pdf-en-US-504220",
      "url": "https://www.axis.com/dam/public/f1/f0/1e/cve-2025-9524pdf-en-US-504220.pdf"
    },
    {
      "published_at": "2025-11-11",
      "title": "Bulletin de s\u00e9curit\u00e9 Axis cve-2025-8998pdf-en-US-504374",
      "url": "https://www.axis.com/dam/public/f5/62/80/cve-2025-8998pdf-en-US-504374.pdf"
    },
    {
      "published_at": "2025-11-11",
      "title": "Bulletin de s\u00e9curit\u00e9 Axis cve-2025-6779pdf-en-US-504217",
      "url": "https://www.axis.com/dam/public/92/9a/13/cve-2025-6779pdf-en-US-504217.pdf"
    },
    {
      "published_at": "2025-11-11",
      "title": "Bulletin de s\u00e9curit\u00e9 Axis cve-2025-4645pdf-en-US-504211",
      "url": "https://www.axis.com/dam/public/69/47/ff/cve-2025-4645pdf-en-US-504211.pdf"
    },
    {
      "published_at": "2025-11-11",
      "title": "Bulletin de s\u00e9curit\u00e9 Axis cve-2025-9055pdf-en-US-504219",
      "url": "https://www.axis.com/dam/public/23/a3/00/cve-2025-9055pdf-en-US-504219.pdf"
    },
    {
      "published_at": "2025-11-11",
      "title": "Bulletin de s\u00e9curit\u00e9 Axis cve-2025-6298pdf-en-US-504215",
      "url": "https://www.axis.com/dam/public/ef/91/c3/cve-2025-6298pdf-en-US-504215.pdf"
    },
    {
      "published_at": "2025-11-11",
      "title": "Bulletin de s\u00e9curit\u00e9 Axis cve-2025-5718pdf-en-US-504214",
      "url": "https://www.axis.com/dam/public/3c/a4/6a/cve-2025-5718pdf-en-US-504214.pdf"
    },
    {
      "published_at": "2025-11-11",
      "title": "Bulletin de s\u00e9curit\u00e9 Axis cve-2025-5454pdf-en-US-504213",
      "url": "https://www.axis.com/dam/public/48/ab/82/cve-2025-5454pdf-en-US-504213.pdf"
    },
    {
      "published_at": "2025-11-11",
      "title": "Bulletin de s\u00e9curit\u00e9 Axis cve-2025-8108pdf-en-US-504218",
      "url": "https://www.axis.com/dam/public/38/20/aa/cve-2025-8108pdf-en-US-504218.pdf"
    },
    {
      "published_at": "2025-11-11",
      "title": "Bulletin de s\u00e9curit\u00e9 Axis cve-2025-5452pdf-en-US-504212",
      "url": "https://www.axis.com/dam/public/39/ba/8b/cve-2025-5452pdf-en-US-504212.pdf"
    },
    {
      "published_at": "2025-11-11",
      "title": "Bulletin de s\u00e9curit\u00e9 Axis cve-2025-6571pdf-en-US-504216",
      "url": "https://www.axis.com/dam/public/1f/f8/f0/cve-2025-6571pdf-en-US-504216.pdf"
    }
  ]
}

CERTFR-2025-AVI-0951

Vulnerability from certfr_avis - Published: 2025-11-03 - Updated: 2025-11-03

De multiples vulnérabilités ont été découvertes dans Axis OS. Elles permettent à un attaquant de provoquer un problème de sécurité non spécifié par l'éditeur.

Solutions

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

Impacted products

	Vendor	Product	Description
	Axis	Axis OS	Axis OS versions 12.x antérieures à 12.7

References

Title

Publication Time

Tags

Bulletin de sécurité Axis

2025-11-03

vendor-advisory

Show details on source website

JSON

To clipboard

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Axis OS versions 12.x ant\u00e9rieures \u00e0 12.7",
      "product": {
        "name": "Axis OS",
        "vendor": {
          "name": "Axis",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": "",
  "content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
  "cves": [
    {
      "name": "CVE-2025-8108",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-8108"
    },
    {
      "name": "CVE-2025-8998",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-8998"
    },
    {
      "name": "CVE-2025-9524",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-9524"
    },
    {
      "name": "CVE-2025-9055",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-9055"
    },
    {
      "name": "CVE-2025-11142",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-11142"
    }
  ],
  "initial_release_date": "2025-11-03T00:00:00",
  "last_revision_date": "2025-11-03T00:00:00",
  "links": [],
  "reference": "CERTFR-2025-AVI-0951",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2025-11-03T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Non sp\u00e9cifi\u00e9 par l\u0027\u00e9diteur"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans Axis OS. Elles permettent \u00e0 un attaquant de provoquer un probl\u00e8me de s\u00e9curit\u00e9 non sp\u00e9cifi\u00e9 par l\u0027\u00e9diteur.",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans Axis OS",
  "vendor_advisories": [
    {
      "published_at": "2025-11-03",
      "title": "Bulletin de s\u00e9curit\u00e9 Axis",
      "url": "https://help.axis.com/en-us/axis-os-release-notes#axis-os-12"
    }
  ]
}

CERTFR-2025-AVI-0985

Vulnerability from certfr_avis - Published: 2025-11-12 - Updated: 2025-11-12

Solutions

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

Impacted products

Vendor	Product	Description
Axis	Axis OS	Axis OS (anciennement LTS) versions 6.x antérieures à 6.50.5.22
Axis	Optimizer	Axis Optimizer versions antérieures à 5.6.0.0
Axis	Axis OS	Axis OS LTS 2024 versions 11.x antérieures à 11.11.178
Axis	Axis OS	Axis OS LTS 2022 versions 10.x antérieures à 10.12.306
Axis	Axis OS	Axis OS (anciennement LTS) versions 8.x antérieures à 8.40.90
Axis	Axis OS	Axis OS LTS 2020 versions 9.x antérieures à 9.80.124
Axis	Axis OS	Axis OS Active Track versions 12.x antérieures à 12.7.33

References

Title

Publication Time

Tags

Bulletin de sécurité Axis cve-2025-10714pdf-en-US-504221	2025-11-11	vendor-advisory
Bulletin de sécurité Axis cve-2025-9524pdf-en-US-504220	2025-11-11	vendor-advisory
Bulletin de sécurité Axis cve-2025-8998pdf-en-US-504374	2025-11-11	vendor-advisory
Bulletin de sécurité Axis cve-2025-6779pdf-en-US-504217	2025-11-11	vendor-advisory
Bulletin de sécurité Axis cve-2025-4645pdf-en-US-504211	2025-11-11	vendor-advisory
Bulletin de sécurité Axis cve-2025-9055pdf-en-US-504219	2025-11-11	vendor-advisory
Bulletin de sécurité Axis cve-2025-6298pdf-en-US-504215	2025-11-11	vendor-advisory
Bulletin de sécurité Axis cve-2025-5718pdf-en-US-504214	2025-11-11	vendor-advisory
Bulletin de sécurité Axis cve-2025-5454pdf-en-US-504213	2025-11-11	vendor-advisory
Bulletin de sécurité Axis cve-2025-8108pdf-en-US-504218	2025-11-11	vendor-advisory
Bulletin de sécurité Axis cve-2025-5452pdf-en-US-504212	2025-11-11	vendor-advisory
Bulletin de sécurité Axis cve-2025-6571pdf-en-US-504216	2025-11-11	vendor-advisory

Show details on source website

JSON

To clipboard

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Axis OS (anciennement LTS) versions 6.x ant\u00e9rieures \u00e0 6.50.5.22",
      "product": {
        "name": "Axis OS",
        "vendor": {
          "name": "Axis",
          "scada": false
        }
      }
    },
    {
      "description": "Axis Optimizer versions ant\u00e9rieures \u00e0 5.6.0.0",
      "product": {
        "name": "Optimizer",
        "vendor": {
          "name": "Axis",
          "scada": false
        }
      }
    },
    {
      "description": "Axis OS LTS 2024 versions 11.x ant\u00e9rieures \u00e0 11.11.178",
      "product": {
        "name": "Axis OS",
        "vendor": {
          "name": "Axis",
          "scada": false
        }
      }
    },
    {
      "description": "Axis OS LTS 2022 versions 10.x ant\u00e9rieures \u00e0 10.12.306",
      "product": {
        "name": "Axis OS",
        "vendor": {
          "name": "Axis",
          "scada": false
        }
      }
    },
    {
      "description": "Axis OS (anciennement LTS) versions 8.x ant\u00e9rieures \u00e0 8.40.90",
      "product": {
        "name": "Axis OS",
        "vendor": {
          "name": "Axis",
          "scada": false
        }
      }
    },
    {
      "description": "Axis OS LTS 2020 versions 9.x ant\u00e9rieures \u00e0 9.80.124",
      "product": {
        "name": "Axis OS",
        "vendor": {
          "name": "Axis",
          "scada": false
        }
      }
    },
    {
      "description": "Axis OS Active Track versions 12.x ant\u00e9rieures \u00e0 12.7.33",
      "product": {
        "name": "Axis OS",
        "vendor": {
          "name": "Axis",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": "",
  "content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
  "cves": [
    {
      "name": "CVE-2025-5718",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-5718"
    },
    {
      "name": "CVE-2025-8108",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-8108"
    },
    {
      "name": "CVE-2025-8998",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-8998"
    },
    {
      "name": "CVE-2025-6571",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-6571"
    },
    {
      "name": "CVE-2025-4645",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-4645"
    },
    {
      "name": "CVE-2025-9524",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-9524"
    },
    {
      "name": "CVE-2025-5454",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-5454"
    },
    {
      "name": "CVE-2025-9055",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-9055"
    },
    {
      "name": "CVE-2025-5452",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-5452"
    },
    {
      "name": "CVE-2025-10714",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-10714"
    },
    {
      "name": "CVE-2025-6298",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-6298"
    },
    {
      "name": "CVE-2025-6779",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-6779"
    }
  ],
  "initial_release_date": "2025-11-12T00:00:00",
  "last_revision_date": "2025-11-12T00:00:00",
  "links": [],
  "reference": "CERTFR-2025-AVI-0985",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2025-11-12T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "D\u00e9ni de service \u00e0 distance"
    },
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    },
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    },
    {
      "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
    },
    {
      "description": "\u00c9l\u00e9vation de privil\u00e8ges"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits Axis. Certaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer une ex\u00e9cution de code arbitraire \u00e0 distance, une \u00e9l\u00e9vation de privil\u00e8ges et un d\u00e9ni de service \u00e0 distance.",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits Axis",
  "vendor_advisories": [
    {
      "published_at": "2025-11-11",
      "title": "Bulletin de s\u00e9curit\u00e9 Axis cve-2025-10714pdf-en-US-504221",
      "url": "https://www.axis.com/dam/public/a2/c7/8c/cve-2025-10714pdf-en-US-504221.pdf"
    },
    {
      "published_at": "2025-11-11",
      "title": "Bulletin de s\u00e9curit\u00e9 Axis cve-2025-9524pdf-en-US-504220",
      "url": "https://www.axis.com/dam/public/f1/f0/1e/cve-2025-9524pdf-en-US-504220.pdf"
    },
    {
      "published_at": "2025-11-11",
      "title": "Bulletin de s\u00e9curit\u00e9 Axis cve-2025-8998pdf-en-US-504374",
      "url": "https://www.axis.com/dam/public/f5/62/80/cve-2025-8998pdf-en-US-504374.pdf"
    },
    {
      "published_at": "2025-11-11",
      "title": "Bulletin de s\u00e9curit\u00e9 Axis cve-2025-6779pdf-en-US-504217",
      "url": "https://www.axis.com/dam/public/92/9a/13/cve-2025-6779pdf-en-US-504217.pdf"
    },
    {
      "published_at": "2025-11-11",
      "title": "Bulletin de s\u00e9curit\u00e9 Axis cve-2025-4645pdf-en-US-504211",
      "url": "https://www.axis.com/dam/public/69/47/ff/cve-2025-4645pdf-en-US-504211.pdf"
    },
    {
      "published_at": "2025-11-11",
      "title": "Bulletin de s\u00e9curit\u00e9 Axis cve-2025-9055pdf-en-US-504219",
      "url": "https://www.axis.com/dam/public/23/a3/00/cve-2025-9055pdf-en-US-504219.pdf"
    },
    {
      "published_at": "2025-11-11",
      "title": "Bulletin de s\u00e9curit\u00e9 Axis cve-2025-6298pdf-en-US-504215",
      "url": "https://www.axis.com/dam/public/ef/91/c3/cve-2025-6298pdf-en-US-504215.pdf"
    },
    {
      "published_at": "2025-11-11",
      "title": "Bulletin de s\u00e9curit\u00e9 Axis cve-2025-5718pdf-en-US-504214",
      "url": "https://www.axis.com/dam/public/3c/a4/6a/cve-2025-5718pdf-en-US-504214.pdf"
    },
    {
      "published_at": "2025-11-11",
      "title": "Bulletin de s\u00e9curit\u00e9 Axis cve-2025-5454pdf-en-US-504213",
      "url": "https://www.axis.com/dam/public/48/ab/82/cve-2025-5454pdf-en-US-504213.pdf"
    },
    {
      "published_at": "2025-11-11",
      "title": "Bulletin de s\u00e9curit\u00e9 Axis cve-2025-8108pdf-en-US-504218",
      "url": "https://www.axis.com/dam/public/38/20/aa/cve-2025-8108pdf-en-US-504218.pdf"
    },
    {
      "published_at": "2025-11-11",
      "title": "Bulletin de s\u00e9curit\u00e9 Axis cve-2025-5452pdf-en-US-504212",
      "url": "https://www.axis.com/dam/public/39/ba/8b/cve-2025-5452pdf-en-US-504212.pdf"
    },
    {
      "published_at": "2025-11-11",
      "title": "Bulletin de s\u00e9curit\u00e9 Axis cve-2025-6571pdf-en-US-504216",
      "url": "https://www.axis.com/dam/public/1f/f8/f0/cve-2025-6571pdf-en-US-504216.pdf"
    }
  ]
}

FKIE_CVE-2025-9524

Vulnerability from fkie_nvd - Published: 2025-11-11 08:15 - Updated: 2026-10-18 21:10

Severity

4.3 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

Summary

References

	URL	Tags
	product-security@axis.com	https://www.axis.com/dam/public/f1/f0/1e/cve-2025-9524pdf-en-US-504220.pdf

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "product": "AXIS OS",
          "vendor": "Axis Communications AB",
          "versions": [
            {
              "lessThan": "6.50.5.21",
              "status": "affected",
              "version": "6.50.0",
              "versionType": "semver"
            },
            {
              "lessThan": "8.40.89",
              "status": "affected",
              "version": "7.0.0",
              "versionType": "semver"
            },
            {
              "lessThan": "9.80.123",
              "status": "affected",
              "version": "9.0.0",
              "versionType": "semver"
            },
            {
              "lessThan": "10.12.305",
              "status": "affected",
              "version": "10.0.0",
              "versionType": "semver"
            },
            {
              "lessThan": "11.11.177",
              "status": "affected",
              "version": "11.0.0",
              "versionType": "semver"
            },
            {
              "lessThan": "12.7.11",
              "status": "affected",
              "version": "12.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "source": "product-security@axis.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "The VAPIX API port.cgi did not have sufficient input validation, which may result in process crashes and impact usability. This vulnerability can only be exploited after authenticating with a viewer- operator- or administrator-privileged service account."
    },
    {
      "lang": "es",
      "value": "El puerto .cgi de la API VAPIX no ten\u00eda suficiente validaci\u00f3n de entrada, lo que podr\u00eda resultar en ca\u00eddas de procesos y tener un impacto en la usabilidad. Esta vulnerabilidad solo puede ser explotada despu\u00e9s de autenticarse con una cuenta de servicio con privilegios de visualizador, operador o administrador."
    }
  ],
  "id": "CVE-2025-9524",
  "lastModified": "2026-10-18T21:10:00.120",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "LOW",
          "baseScore": 4.3,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 1.4,
        "source": "product-security@axis.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-9524",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2025-11-14T17:54:12.194729Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2025-11-11T08:15:35.213",
  "references": [
    {
      "source": "product-security@axis.com",
      "url": "https://www.axis.com/dam/public/f1/f0/1e/cve-2025-9524pdf-en-US-504220.pdf"
    }
  ],
  "sourceIdentifier": "product-security@axis.com",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-1287"
        }
      ],
      "source": "product-security@axis.com",
      "type": "Secondary"
    }
  ]
}

GHSA-3GHV-QQMP-P6C4

Vulnerability from github – Published: 2025-11-11 09:30 – Updated: 2025-11-11 09:30

Details

Severity

4.3 (Medium)


                  
                    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2025-9524"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-1287"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-11-11T08:15:35Z",
    "severity": "MODERATE"
  },
  "details": "The VAPIX API port.cgi did not have sufficient input validation, which may result in process crashes and impact usability. This vulnerability can only be exploited after authenticating with a viewer- operator- or administrator-privileged service account.",
  "id": "GHSA-3ghv-qqmp-p6c4",
  "modified": "2025-11-11T09:30:31Z",
  "published": "2025-11-11T09:30:31Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-9524"
    },
    {
      "type": "WEB",
      "url": "https://www.axis.com/dam/public/f1/f0/1e/cve-2025-9524pdf-en-US-504220.pdf"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L",
      "type": "CVSS_V3"
    }
  ]
}

WID-SEC-W-2025-2546

Vulnerability from csaf_certbund - Published: 2025-11-10 23:00 - Updated: 2025-11-12 23:00

Summary

Axis Axis OS: Mehrere Schwachstellen

Severity

Mittel

Scope

11 vulnerabilities in this advisory, including CVE-2025-9524.

CVE-2025-9524

Known affected: 6 products

Open the full advisory

Tags

Taxonomy of the tags.

All sightings related to this event Export sightings related to this event

Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.

Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.

Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2025-9524 (GCVE-0-2025-9524)

CERTFR-2025-AVI-0951

Solutions

CERTFR-2025-AVI-0985

Solutions

CERTFR-2025-AVI-0951

Solutions

CERTFR-2025-AVI-0985

Solutions

FKIE_CVE-2025-9524

GHSA-3GHV-QQMP-P6C4

WID-SEC-W-2025-2546

Tags

Sightings

Nomenclature

Vulnerability timeline

Related by attack behaviour