CVE-2025-9524 — Improper Validation of Specified Type of Input in Communications AB Axis OS

CWE-1287 — Improper Validation of Specified Type of Input3 documents3 sources

Severity

4.3MEDIUMNVD

EPSS

0.1%

top 78.83%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Axis Communications AB Axis OS

Timeline

PublishedNov 11

Description

The VAPIX API port.cgi did not have sufficient input validation, which may result in process crashes and impact usability. This vulnerability can only be exploited after authenticating with a viewer- operator- or administrator-privileged service account.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:LExploitability: 2.8 | Impact: 1.4

Affected Packages1 packages

▶CVEListV5axis_communications_ab/axis_os6.50.0 — 6.50.5.21+5

🔴Vulnerability Details

GHSA

GHSA-3ghv-qqmp-p6c4: The VAPIX API port↗2025-11-11

▶

CVEList

CVE-2025-9524: The VAPIX API port↗2025-11-11

▶