CVE-2025-0360

published 2025-03-04

CVE-2025-0360: During an annual penetration test conducted on behalf of Axis Communication, Truesec discovered a flaw in the VAPIX Device Configuration framework that could…

Priority P3 41 high 7.8 CVSS 3.1

AV L AC L PR L UI N S U C H I H A H

During an annual penetration test conducted on behalf of Axis Communication, Truesec discovered a flaw in the VAPIX Device Configuration framework that could lead to an incorrect user privilege level in the VAPIX service account D-Bus API.

Affected

4 ranges

Vendor	Product	Version range	Fixed in
axis	axis_os	>= 11.11.0 < 12.2.41	12.2.41
axis	axis_os_2024	< 11.11.135	11.11.135
axis_communications_ab	axis_os	>= 11.11.0 < 11.11.135	11.11.135
axis_communications_ab	axis_os	>= 12.0.0 < 12.2.41	12.2.41

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-863