Axis AXIS OS up to 12.6.39 ACAP Configuration File permission assignment

Summaryinfo

A vulnerability has been found in Axis AXIS OS up to 12.6.39 and classified as critical. Impacted is an unknown function of the component ACAP Configuration File Handler. This manipulation causes permission assignment. This vulnerability is handled as CVE-2025-6779. It is possible to launch the attack on the local host. There is not any exploit available. The affected component should be upgraded.

Detailsinfo

A vulnerability classified as critical was found in Axis AXIS OS up to 12.6.39. Affected by this vulnerability is an unknown part of the component ACAP Configuration File Handler. The manipulation with an unknown input leads to a permission assignment vulnerability. The CWE definition for the vulnerability is CWE-732. The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

An ACAP configuration file has improper permissions, which could allow command injection and potentially lead to privilege escalation. This vulnerability can only be exploited if the Axis device is configured to allow the installation of unsigned ACAP applications, and if an attacker convinces the victim to install a malicious ACAP application.

The weakness was released by URCQ. It is possible to read the advisory at axis.com. This vulnerability is known as CVE-2025-6779 since 06/27/2025. The exploitation appears to be easy. Attacking locally is a requirement. The exploitation needs additional levels of successful authentication. The technical details are unknown and an exploit is not publicly available.

Upgrading to version 12.6.40 eliminates this vulnerability.

The vulnerability is also documented in the databases at EUVD (EUVD-2025-74040) and CERT Bund (WID-SEC-2025-2546). Be aware that VulDB is the high quality source for vulnerability data.

Affected

• Axis Axis OS

Productinfo

Vendor

• Axis

Name

• AXIS OS

Version

• 12.6.0
• 12.6.1
• 12.6.2
• 12.6.3
• 12.6.4
• 12.6.5
• 12.6.6
• 12.6.7
• 12.6.8
• 12.6.9
• 12.6.10
• 12.6.11
• 12.6.12
• 12.6.13
• 12.6.14
• 12.6.15
• 12.6.16
• 12.6.17
• 12.6.18
• 12.6.19
• 12.6.20
• 12.6.21
• 12.6.22
• 12.6.23
• 12.6.24
• 12.6.25
• 12.6.26
• 12.6.27
• 12.6.28
• 12.6.29
• 12.6.30
• 12.6.31
• 12.6.32
• 12.6.33
• 12.6.34
• 12.6.35
• 12.6.36
• 12.6.37
• 12.6.38
• 12.6.39

License

• free

Website

• Vendor: https://www.axis.com/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion