CVE-2025-0361

State: Published
Severity: 4.3 Medium
Published: Apr 8, 2025
Updated: Apr 8, 2025
Reserved: Jan 9, 2025

Description

During an annual penetration test conducted on behalf of Axis Communications, Truesec discovered a flaw in the VAPIX Device Configuration framework that allowed for unauthenticated username enumeration through the VAPIX Device Configuration SSH Management API.

Scores

CVSS	Score	Vector	Source
3.1	4.3 Medium	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N	Axis

Weaknesses

CWE-203 Observable Discrepancy

Affected Products

Product	Versions
AXIS OSAxis Communications AB	11.11.0 to before 11.11.141Affected 12.0.0 to before 12.3.56Affected

References

https://www.axis.com/dam/public/f4/9b/13/cve-2025-0361pdf-en-US-474511.pdf

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.