CVE-2025-0325

published 2025-06-02

CVE-2025-0325: A Guard Tour VAPIX API parameter allowed the use of arbitrary values and can be incorrectly called, allowing an attacker to block access to the guard tour…

Priority P4 26 medium 4.3 CVSS 3.1

AV N AC L PR L UI N S U C N I N A L

A Guard Tour VAPIX API parameter allowed the use of arbitrary values and can be incorrectly called, allowing an attacker to block access to the guard tour configuration page in the web interface of the Axis device.

Affected

6 ranges

Vendor	Product	Version range	Fixed in
axis_communications_ab	axis_os	>= 10.0.0 < 10.12.278	10.12.278
axis_communications_ab	axis_os	>= 11.0.0 < 11.11.142	11.11.142
axis_communications_ab	axis_os	>= 12.0.0 < 12.4.28	12.4.28
axis_communications_ab	axis_os	>= 6.50.0 < 6.50.5.21	6.50.5.21
axis_communications_ab	axis_os	>= 7.0.0 < 8.40.74	8.40.74
axis_communications_ab	axis_os	>= 9.0.0 < 9.80.100	9.80.100

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-628 CWE-1287