CVE-2025-5452
- State
- Published
- Severity
- 6.6 Medium
- Published
- Nov 11, 2025
- Updated
- Feb 26, 2026
- Reserved
- Jun 2, 2025
Description
A malicious ACAP application can gain access to admin-level service account credentials used by legitimate ACAP applications, leading to potential privilege escalation of the malicious ACAP application. This vulnerability can only be exploited if the Axis device is configured to allow the installation of unsigned ACAP applications, and if an attacker convinces the victim to install a malicious ACAP application.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 6.6 Medium | CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H | Axis |
Weaknesses
- CWE-214 Invocation of Process Using Visible Sensitive Information
Affected Products
| Product | Versions |
|---|---|
AXIS OSAxis Communications AB |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.