« Volver al listado

CVE-2025-12063

Estado: AnalizadaMedia (5.7)—

An insecure direct object reference allowed a non-admin user to modify or remove certain data objects without having the appropriate permissions.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Axis — Camera Station PRO

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2025-12063",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-12063",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-02-10T20:16:51.460464Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "product-security@axis.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 5.7,
          "attackVector": "ADJACENT_NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 2.1
      }
    ]
  },
  "affected": [
    {
      "source": "product-security@axis.com",
      "affectedData": [
        {
          "vendor": "Axis Communications AB",
          "product": "AXIS Camera Station Pro",
          "versions": [
            {
              "status": "affected",
              "version": "6",
              "lessThan": "6.14",
              "versionType": "semver"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2026-02-10T07:16:12.553",
  "references": [
    {
      "url": "https://www.axis.com/dam/public/bc/f0/5a/cve-2025-12063pdf-en-US-519288.pdf",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "product-security@axis.com"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "product-security@axis.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-639"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "An insecure direct object reference allowed a non-admin user to modify or remove certain data objects without having the appropriate permissions."
    },
    {
      "lang": "es",
      "value": "Una referencia directa insegura a objeto permitió a un usuario no administrador modificar o eliminar ciertos objetos de datos sin tener los permisos adecuados."
    }
  ],
  "lastModified": "2026-06-17T08:31:39.343",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:axis:camera_station_pro:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F257DBF0-2884-4BC6-9C49-5BDD1F0824EA",
              "versionEndExcluding": "6.14.10768"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "product-security@axis.com"
}