CVE-2025-0359

During an annual penetration test conducted on behalf of Axis Communication, Truesec discovered a flaw in the ACAP Application framework that allowed applications to access restricted D-Bus methods within the framework. Axis has released patched AXIS OS versions for the highlighted flaw. Please refer to the Axis security advisory for more information and solution.

CVSS v3 8.5 HIGH

8.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.5 / Impact : 5.3

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact HIGH

Availability Impact LOW

Scope CHANGED

References

Link	Resource
https://www.axis.com/dam/public/68/08/c5/cve-2025-0359pdf-en-US-466885.pdf	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:o:axis:axis_os:::::active:::*
	cpe:2.3:o:axis:axis_os_2024:::::lts:::*

History

22 Jan 2026, 21:01

Type	Values Removed	Values Added
References	~~() https://www.axis.com/dam/public/68/08/c5/cve-2025-0359pdf-en-US-466885.pdf -~~	() https://www.axis.com/dam/public/68/08/c5/cve-2025-0359pdf-en-US-466885.pdf - Vendor Advisory
First Time		Axis axis Os Axis axis Os 2024 Axis
CPE		cpe:2.3:o:axis:axis_os:::::active:::* cpe:2.3:o:axis:axis_os_2024:::::lts:::*
Summary		(es) Durante una prueba de penetración anual realizada en nombre de Axis Communication, Truesec descubrió una falla en el marco de la aplicación ACAP que permitía a las aplicaciones acceder a métodos D-Bus restringidos dentro del framework. Axis ha publicado versiones parcheadas del sistema operativo AXIS para la falla destacada. Consulte el aviso de seguridad de Axis para obtener más información y soluciones.

04 Mar 2025, 06:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2025-03-04 06:15

Updated : 2026-01-22 21:01

NVD link : CVE-2025-0359

Mitre link : CVE-2025-0359

CVE.ORG link : CVE-2025-0359

JSON object : View

Products Affected

axis

axis_os_2024
axis_os

CWE

CWE-863

Incorrect Authorization

{"id": "CVE-2025-0359", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "product-security@axis.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 8.5, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:L", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 5.3, "exploitabilityScore": 2.5}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.5, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 1.8}]}, "published": "2025-03-04T06:15:30.023", "references": [{"url": "https://www.axis.com/dam/public/68/08/c5/cve-2025-0359pdf-en-US-466885.pdf", "tags": ["Vendor Advisory"], "source": "product-security@axis.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "product-security@axis.com", "description": [{"lang": "en", "value": "CWE-863"}]}], "descriptions": [{"lang": "en", "value": "During an annual penetration test conducted on behalf of Axis Communication, Truesec discovered a flaw in the ACAP Application framework that allowed applications to access restricted D-Bus methods within the framework. \nAxis has released patched AXIS OS versions for the highlighted flaw. Please refer to the Axis security advisory for more information and solution."}, {"lang": "es", "value": "Durante una prueba de penetraci\u00f3n anual realizada en nombre de Axis Communication, Truesec descubri\u00f3 una falla en el marco de la aplicaci\u00f3n ACAP que permit\u00eda a las aplicaciones acceder a m\u00e9todos D-Bus restringidos dentro del framework. Axis ha publicado versiones parcheadas del sistema operativo AXIS para la falla destacada. Consulte el aviso de seguridad de Axis para obtener m\u00e1s informaci\u00f3n y soluciones."}], "lastModified": "2026-01-22T21:01:59.243", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:axis:axis_os:*:*:*:*:active:*:*:*", "vulnerable": true, "matchCriteriaId": "4CE29EC9-EB6F-44EF-ACBB-A484B7D8E7E6", "versionEndExcluding": "12.2.52", "versionStartIncluding": "11.11.0"}, {"criteria": "cpe:2.3:o:axis:axis_os_2024:*:*:*:*:lts:*:*:*", "vulnerable": true, "matchCriteriaId": "A3ACD321-ABF7-46AE-A389-E8FD76EF0C51", "versionEndExcluding": "11.11.135"}], "operator": "OR"}]}], "sourceIdentifier": "product-security@axis.com"}