« Volver al listado

CVE-2025-0359

Estado: AnalizadaMedia (5.5)—

During an annual penetration test conducted on behalf of Axis Communication, Truesec discovered a flaw in the ACAP Application framework that allowed applications to access restricted D-Bus methods within the framework. Axis has released patched AXIS OS versions for the highlighted flaw. Please refer to the Axis security advisory for more information and solution.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (2)

Axis — Axis OSAxis — Axis OS 2024

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2025-0359",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-0359",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-03-04T15:18:21.373964Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "product-security@axis.com",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 8.5,
          "attackVector": "LOCAL",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:L",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "LOW",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 5.3,
        "exploitabilityScore": 2.5
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 5.5,
          "attackVector": "LOCAL",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 1.8
      }
    ]
  },
  "affected": [
    {
      "source": "product-security@axis.com",
      "affectedData": [
        {
          "vendor": "Axis Communications AB",
          "product": "AXIS OS",
          "versions": [
            {
              "status": "affected",
              "version": "11.11.0",
              "lessThan": "11.11.135",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "12.0.0",
              "lessThan": "12.2.52",
              "versionType": "semver"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2025-03-04T06:15:30.023",
  "references": [
    {
      "url": "https://www.axis.com/dam/public/68/08/c5/cve-2025-0359pdf-en-US-466885.pdf",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "product-security@axis.com"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "product-security@axis.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-863"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "During an annual penetration test conducted on behalf of Axis Communication, Truesec discovered a flaw in the ACAP Application framework that allowed applications to access restricted D-Bus methods within the framework. \nAxis has released patched AXIS OS versions for the highlighted flaw. Please refer to the Axis security advisory for more information and solution."
    },
    {
      "lang": "es",
      "value": "Durante una prueba de penetración anual realizada en nombre de Axis Communication, Truesec descubrió una falla en el marco de la aplicación ACAP que permitía a las aplicaciones acceder a métodos D-Bus restringidos dentro del framework. Axis ha publicado versiones parcheadas del sistema operativo AXIS para la falla destacada. Consulte el aviso de seguridad de Axis para obtener más información y soluciones."
    }
  ],
  "lastModified": "2026-06-17T08:26:20.757",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:axis:axis_os:*:*:*:*:active:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "4CE29EC9-EB6F-44EF-ACBB-A484B7D8E7E6",
              "versionEndExcluding": "12.2.52",
              "versionStartIncluding": "11.11.0"
            },
            {
              "criteria": "cpe:2.3:o:axis:axis_os_2024:*:*:*:*:lts:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A3ACD321-ABF7-46AE-A389-E8FD76EF0C51",
              "versionEndExcluding": "11.11.135"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "product-security@axis.com"
}