CVE-2025-5452
MediumCVSS 6.6Exploitation Probability (EPSS)
Low risk23th percentile - higher than 23% of all known CVEs
Summary
A malicious ACAP application can gain access to admin-level service account credentials used by legitimate ACAP applications, leading to potential privilege escalation of the malicious ACAP application. This vulnerability can only be exploited if the Axis device is configured to allow the installation of unsigned ACAP applications, and if an attacker convinces the victim to install a malicious ACAP application.
Risk Assessment
If an Axis device allows unsigned ACAP applications, an attacker can install a malicious app and gain admin privileges, taking control of the device. This may lead to further network attacks.
Recommendation
Disable the installation of unsigned ACAP applications on Axis devices unless absolutely necessary. Regularly review installed applications and verify their origin.
Other vulnerabilities in Axis ACAP
See all- CVE-2025-6779Medium
An ACAP configuration file has improper permissions, which could allow command injection and potentially lead to privilege escalation. This vulnerability can only be exploited if the Axis device is configured to allow the installation of unsigned ACAP applications, and if an attacker convinces the victim to install a malicious ACAP application.
- CVE-2025-5454Medium
An ACAP configuration file lacked sufficient input validation, which could allow a path traversal attack leading to potential privilege escalation. This vulnerability can only be exploited if the Axis device is configured to allow the installation of unsigned ACAP applications, and if an attacker convinces the victim to install a malicious ACAP application.
Original NVD description (English source)
A malicious ACAP application can gain access to admin-level service account credentials used by legitimate ACAP applications, leading to potential privilege escalation of the malicious ACAP application. This vulnerability can only be exploited if the Axis device is configured to allow the installation of unsigned ACAP applications, and if an attacker convinces the victim to install a malicious ACAP application.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS