Logo
-

Byte Open Security

(ByteOS Network)

Log In

Sign Up

ByteOS

Security
Vulnerability Details
Registries
Custom Views
Weaknesses
Attack Patterns
Filters & Tools
Vulnerability Details :

CVE-2025-0358

Summary
Assigner-Axis
Assigner Org ID-f2daf9a0-02c2-4b83-a01d-63b3b304b807
Published At-02 Jun, 2025 | 07:39
Updated At-02 Jun, 2025 | 12:59
Rejected At-
Credits

During an annual penetration test conducted on behalf of Axis Communication, Truesec discovered a flaw in the VAPIX Device Configuration framework that allowed a privilege escalation, enabling a lower-privileged user to gain administrator privileges.

Vendors
-
Not available
Products
-
Metrics (CVSS)
VersionBase scoreBase severityVector
Weaknesses
Attack Patterns
Solution/Workaround
References
HyperlinkResource Type
EPSS History
Score
Latest Score
-
N/A
No data available for selected date range
Percentile
Latest Percentile
-
N/A
No data available for selected date range
Stakeholder-Specific Vulnerability Categorization (SSVC)
▼Common Vulnerabilities and Exposures (CVE)
cve.org
Assigner:Axis
Assigner Org ID:f2daf9a0-02c2-4b83-a01d-63b3b304b807
Published At:02 Jun, 2025 | 07:39
Updated At:02 Jun, 2025 | 12:59
Rejected At:
▼CVE Numbering Authority (CNA)

During an annual penetration test conducted on behalf of Axis Communication, Truesec discovered a flaw in the VAPIX Device Configuration framework that allowed a privilege escalation, enabling a lower-privileged user to gain administrator privileges.

Affected Products
Vendor
Axis Communications AB
Product
AXIS OS
Default Status
unaffected
Versions
Affected
  • From 12.0.0 before 12.4.0 (semver)
Problem Types
TypeCWE IDDescription
CWECWE-269CWE-269: Improper Privilege Management
Type: CWE
CWE ID: CWE-269
Description: CWE-269: Improper Privilege Management
Metrics
VersionBase scoreBase severityVector
3.18.8HIGH
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Version: 3.1
Base score: 8.8
Base severity: HIGH
Vector:
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Metrics Other Info
Impacts
CAPEC IDDescription
Solutions
Configurations
Workarounds
Exploits
Credits
Timeline
EventDate
Replaced By
Rejected Reason
References
HyperlinkResource
https://www.axis.com/dam/public/35/90/85/cve-2025-0358pdf-en-US-483809.pdf
N/A
Hyperlink: https://www.axis.com/dam/public/35/90/85/cve-2025-0358pdf-en-US-483809.pdf
Resource: N/A
▼Authorized Data Publishers (ADP)
CISA ADP Vulnrichment
Affected Products
Metrics
VersionBase scoreBase severityVector
Metrics Other Info
Impacts
CAPEC IDDescription
Solutions
Configurations
Workarounds
Exploits
Credits
Timeline
EventDate
Replaced By
Rejected Reason
References
HyperlinkResource
Information is not available yet
▼National Vulnerability Database (NVD)
nvd.nist.gov
Source:product-security@axis.com
Published At:02 Jun, 2025 | 08:15
Updated At:02 Jun, 2025 | 17:32

During an annual penetration test conducted on behalf of Axis Communication, Truesec discovered a flaw in the VAPIX Device Configuration framework that allowed a privilege escalation, enabling a lower-privileged user to gain administrator privileges.

CISA Catalog
Date AddedDue DateVulnerability NameRequired Action
N/A
Date Added: N/A
Due Date: N/A
Vulnerability Name: N/A
Required Action: N/A
Metrics
TypeVersionBase scoreBase severityVector
Secondary3.18.8HIGH
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Type: Secondary
Version: 3.1
Base score: 8.8
Base severity: HIGH
Vector:
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
CPE Matches
Weaknesses
CWE IDTypeSource
CWE-269Secondaryproduct-security@axis.com
CWE ID: CWE-269
Type: Secondary
Source: product-security@axis.com
Evaluator Description
Evaluator Impact

Evaluator Solution

Vendor Statements
References
HyperlinkSourceResource
https://www.axis.com/dam/public/35/90/85/cve-2025-0358pdf-en-US-483809.pdfproduct-security@axis.com
N/A
Hyperlink: https://www.axis.com/dam/public/35/90/85/cve-2025-0358pdf-en-US-483809.pdf
Source: product-security@axis.com
Resource: N/A

Change History

0
Information is not available yet

Similar CVEs

54Records found
CVE-2024-21807
Matching Score-4
Assigner-Intel Corporation
ShareView Details
Matching Score-4
Assigner-Intel Corporation
CVSS Score-9.3||CRITICAL
EPSS-0.03% / 7.20%
||
7 Day CHG~0.00%
Published-14 Aug, 2024 | 13:45
Updated-16 Aug, 2024 | 04:01
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

Improper initialization in the Linux kernel mode driver for some Intel(R) Ethernet Network Controllers and Adapters before version 28.3 may allow an authenticated user to potentially enable escalation of privilege via local access.

Action-Not Available
Vendor-n/aIntel Corporation
Product-Intel(R) Ethernet Network Controllers and Adaptersethernet_complete_driver_pack
CWE ID-CWE-269
Improper Privilege Management
CWE ID-CWE-665
Improper Initialization
CVE-2022-38060
Matching Score-4
Assigner-Talos
ShareView Details
Matching Score-4
Assigner-Talos
CVSS Score-8.8||HIGH
EPSS-0.02% / 4.17%
||
7 Day CHG~0.00%
Published-21 Dec, 2022 | 23:14
Updated-07 May, 2025 | 14:15
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

A privilege escalation vulnerability exists in the sudo functionality of OpenStack Kolla git master 05194e7618. A misconfiguration in /etc/sudoers within a container can lead to increased privileges.

Action-Not Available
Vendor-OpenStack
Product-kollaOpenStack
CWE ID-CWE-269
Improper Privilege Management
CWE ID-CWE-426
Untrusted Search Path
CVE-2024-4018
Matching Score-4
Assigner-BeyondTrust Inc.
ShareView Details
Matching Score-4
Assigner-BeyondTrust Inc.
CVSS Score-8.8||HIGH
EPSS-0.06% / 17.50%
||
7 Day CHG~0.00%
Published-19 Apr, 2024 | 20:29
Updated-01 Aug, 2024 | 20:26
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
Privilege Escalation in U-Series Appliance

Improper Privilege Management vulnerability in BeyondTrust U-Series Appliance on Windows, 64 bit (local appliance api modules) allows Privilege Escalation.This issue affects U-Series Appliance: from 3.4 before 4.0.3.

Action-Not Available
Vendor-BeyondTrust Corporation
Product-U-Series Applianceu-series_appliance
CWE ID-CWE-269
Improper Privilege Management
CVE-2020-9046
Matching Score-4
Assigner-Johnson Controls
ShareView Details
Matching Score-4
Assigner-Johnson Controls
CVSS Score-8.8||HIGH
EPSS-0.04% / 11.42%
||
7 Day CHG~0.00%
Published-26 May, 2020 | 20:05
Updated-04 Aug, 2024 | 10:19
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
Kantech EntraPass Security Management Software - System Permissions Vulnerability

A vulnerability in all versions of Kantech EntraPass Editions could potentially allow an authorized low-privileged user to gain full system-level privileges by replacing critical files with specifically crafted files.

Action-Not Available
Vendor-johnsoncontrolsJohnson Controls
Product-kantech_entrapassKantech EntraPass Security Management Software Special Edition versions 8.22 and priorKantech EntraPass Security Management Software Global Edition versions 8.22 and priorKantech EntraPass Security Management Software Corporate Edition versions 8.22 and prior
CWE ID-CWE-284
Improper Access Control
CWE ID-CWE-269
Improper Privilege Management
  • Previous
  • 1
  • 2
  • Next
Details not found