Axis OS up to 12.7.26 Temporary Directory file inclusion

Summaryinfo

A vulnerability, which was classified as problematic, has been found in Axis OS up to 8.40.89/9.80.123/10.12.305/11.11.177/12.7.26. This vulnerability affects unknown code of the component Temporary Directory Handler. The manipulation leads to file inclusion. This vulnerability is traded as CVE-2025-8998. It is possible to initiate the attack remotely. There is no exploit available. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability was found in Axis OS up to 8.40.89/9.80.123/10.12.305/11.11.177/12.7.26. It has been rated as problematic. This issue affects an unknown functionality of the component Temporary Directory Handler. The manipulation with an unknown input leads to a file inclusion vulnerability. Using CWE to declare the problem leads to CWE-73. The product allows user input to control or influence paths or file names that are used in filesystem operations. Impacted is availability. The summary by CVE is:

It was possible to upload files with a specific name to a temporary directory, which may result in process crashes and impact usability. This flaw can only be exploited after authenticating with an operator- or administrator-privileged service account.

The weakness was shared by Mucoze. The advisory is shared at axis.com. The identification of this vulnerability is CVE-2025-8998 since 08/13/2025. The exploitation is known to be difficult. The attack may be initiated remotely. Neither technical details nor an exploit are publicly available.

Upgrading to version 6.50.5.22, 8.40.90, 9.80.124, 10.12.306, 11.11.178 or 12.7.27 eliminates this vulnerability.

The vulnerability is also documented in the databases at EUVD (EUVD-2025-74037) and CERT Bund (WID-SEC-2025-2546). If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Affected

• Axis Axis OS

Productinfo

Vendor

• Axis

Name

• OS

Version

• 8.40.0
• 8.40.1
• 8.40.2
• 8.40.3
• 8.40.4
• 8.40.5
• 8.40.6
• 8.40.7
• 8.40.8
• 8.40.9
• 8.40.10
• 8.40.11
• 8.40.12
• 8.40.13
• 8.40.14
• 8.40.15
• 8.40.16
• 8.40.17
• 8.40.18
• 8.40.19
• 8.40.20
• 8.40.21
• 8.40.22
• 8.40.23
• 8.40.24
• 8.40.25
• 8.40.26
• 8.40.27
• 8.40.28
• 8.40.29
• 8.40.30
• 8.40.31
• 8.40.32
• 8.40.33
• 8.40.34
• 8.40.35
• 8.40.36
• 8.40.37
• 8.40.38
• 8.40.39
• 8.40.40
• 8.40.41
• 8.40.42
• 8.40.43
• 8.40.44
• 8.40.45
• 8.40.46
• 8.40.47
• 8.40.48
• 8.40.49
• 8.40.50
• 8.40.51
• 8.40.52
• 8.40.53
• 8.40.54
• 8.40.55
• 8.40.56
• 8.40.57
• 8.40.58
• 8.40.59
• 8.40.60
• 8.40.61
• 8.40.62
• 8.40.63
• 8.40.64
• 8.40.65
• 8.40.66
• 8.40.67
• 8.40.68
• 8.40.69
• 8.40.70
• 8.40.71
• 8.40.72
• 8.40.73
• 8.40.74
• 8.40.75
• 8.40.76
• 8.40.77
• 8.40.78
• 8.40.79
• 8.40.80
• 8.40.81
• 8.40.82
• 8.40.83
• 8.40.84
• 8.40.85
• 8.40.86
• 8.40.87
• 8.40.88
• 8.40.89
• 9.80.123
• 10.12.305
• 11.11.177
• 12.7.0
• 12.7.1
• 12.7.2
• 12.7.3
• 12.7.4
• 12.7.5
• 12.7.6
• 12.7.7
• 12.7.8
• 12.7.9
• 12.7.10
• 12.7.11
• 12.7.12
• 12.7.13
• 12.7.14
• 12.7.15
• 12.7.16
• 12.7.17
• 12.7.18
• 12.7.19
• 12.7.20
• 12.7.21
• 12.7.22
• 12.7.23
• 12.7.24
• 12.7.25
• 12.7.26

License

• free

Website

• Vendor: https://www.axis.com/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion