« Volver al listado

CVE-2025-0360

Estado: AnalizadaAlta (7.8)—

During an annual penetration test conducted on behalf of Axis Communication, Truesec discovered a flaw in the VAPIX Device Configuration framework that could lead to an incorrect user privilege level in the VAPIX service account D-Bus API.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

Vector AV:L/PR:L/UI:N indica escalada local sin interacción. La falla en privilegios VAPIX D-Bus permite elevar permisos de cuenta de servicio (T1068), facilitando creación/modificación de cuentas (T1078, T1556) en el dispositivo Axis.

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

User Account ManagementPrivileged Account ManagementPassword PoliciesMulti-factor AuthenticationApplication Developer GuidanceActive Directory Configuration

Tecnologías afectadas (2)

Axis — Axis OSAxis — Axis OS 2024

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2025-0360",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-0360",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-03-04T15:24:36.501277Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "product-security@axis.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.8,
          "attackVector": "LOCAL",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 1.8
      }
    ]
  },
  "affected": [
    {
      "source": "product-security@axis.com",
      "affectedData": [
        {
          "vendor": "Axis Communications AB",
          "product": "AXIS OS",
          "versions": [
            {
              "status": "affected",
              "version": "11.11.0",
              "lessThan": "11.11.135",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "12.0.0",
              "lessThan": "12.2.41",
              "versionType": "semver"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2025-03-04T06:15:30.180",
  "references": [
    {
      "url": "https://www.axis.com/dam/public/b1/fe/46/cve-2025-0360pdf-en-US-466887.pdf",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "product-security@axis.com"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "product-security@axis.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-863"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "During an annual penetration test conducted on behalf of Axis Communication, Truesec discovered a flaw in the VAPIX Device Configuration framework that could lead to an incorrect user privilege level in the VAPIX service account D-Bus API."
    },
    {
      "lang": "es",
      "value": "Durante una prueba de penetración anual realizada en nombre de Axis Communication, Truesec descubrió una falla en el marco de configuración del dispositivo VAPIX que podría generar un nivel de privilegio de usuario incorrecto en la API D-Bus de la cuenta de servicio VAPIX."
    }
  ],
  "lastModified": "2026-06-17T08:26:20.870",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:axis:axis_os:*:*:*:*:active:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "6D92D756-A9D3-445F-B4E6-B3FC2D1FB081",
              "versionEndExcluding": "12.2.41",
              "versionStartIncluding": "11.11.0"
            },
            {
              "criteria": "cpe:2.3:o:axis:axis_os_2024:*:*:*:*:lts:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A3ACD321-ABF7-46AE-A389-E8FD76EF0C51",
              "versionEndExcluding": "11.11.135"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "product-security@axis.com"
}