Axis AXIS OS up to 12.6.68 ACAP invocation of process using visible sensitive information

Summaryinfo

A vulnerability was found in Axis AXIS OS up to 12.6.68. It has been classified as critical. The impacted element is an unknown function of the component ACAP Handler. Performing a manipulation results in invocation of process using visible sensitive information. This vulnerability was named CVE-2025-5452. The attack may be initiated remotely. There is no available exploit. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability, which was classified as critical, was found in Axis AXIS OS up to 12.6.68. This affects an unknown code block of the component ACAP Handler. The manipulation with an unknown input leads to a invocation of process using visible sensitive information vulnerability. CWE is classifying the issue as CWE-214. A process is invoked with sensitive command-line arguments, environment variables, or other elements that can be seen by other processes on the operating system. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

A malicious ACAP application can gain access to admin-level service account credentials used by legitimate ACAP applications, leading to potential privilege escalation of the malicious ACAP application. This vulnerability can only be exploited if the Axis device is configured to allow the installation of unsigned ACAP applications, and if an attacker convinces the victim to install a malicious ACAP application.

The weakness was presented by Keanesec. The advisory is shared at axis.com. This vulnerability is uniquely identified as CVE-2025-5452 since 06/02/2025. The exploitability is told to be difficult. It is possible to initiate the attack remotely. Additional levels of successful authentication are necessary for exploitation. Neither technical details nor an exploit are publicly available. MITRE ATT&CK project uses the attack technique T1592 for this issue.

Upgrading to version 12.6.69 eliminates this vulnerability.

The vulnerability is also documented in the databases at EUVD (EUVD-2025-74042) and CERT Bund (WID-SEC-2025-2546). Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Affected

• Axis Axis OS

Productinfo

Vendor

• Axis

Name

• AXIS OS

Version

• 12.6.0
• 12.6.1
• 12.6.2
• 12.6.3
• 12.6.4
• 12.6.5
• 12.6.6
• 12.6.7
• 12.6.8
• 12.6.9
• 12.6.10
• 12.6.11
• 12.6.12
• 12.6.13
• 12.6.14
• 12.6.15
• 12.6.16
• 12.6.17
• 12.6.18
• 12.6.19
• 12.6.20
• 12.6.21
• 12.6.22
• 12.6.23
• 12.6.24
• 12.6.25
• 12.6.26
• 12.6.27
• 12.6.28
• 12.6.29
• 12.6.30
• 12.6.31
• 12.6.32
• 12.6.33
• 12.6.34
• 12.6.35
• 12.6.36
• 12.6.37
• 12.6.38
• 12.6.39
• 12.6.40
• 12.6.41
• 12.6.42
• 12.6.43
• 12.6.44
• 12.6.45
• 12.6.46
• 12.6.47
• 12.6.48
• 12.6.49
• 12.6.50
• 12.6.51
• 12.6.52
• 12.6.53
• 12.6.54
• 12.6.55
• 12.6.56
• 12.6.57
• 12.6.58
• 12.6.59
• 12.6.60
• 12.6.61
• 12.6.62
• 12.6.63
• 12.6.64
• 12.6.65
• 12.6.66
• 12.6.67
• 12.6.68

License

• free

Website

• Vendor: https://www.axis.com/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion