CVE-2025-0360 Overview
CVE-2025-0360 is a privilege escalation vulnerability in the VAPIX Device Configuration framework used by Axis Communications products. Truesec identified the flaw during an annual penetration test conducted on behalf of Axis Communications. The defect allows an incorrect user privilege level to be assigned within the VAPIX service account D-Bus API, breaking the authorization boundary enforced by [CWE-863].
An authenticated local attacker can leverage the flaw to obtain elevated privileges on affected AXIS OS devices. Successful exploitation impacts confidentiality, integrity, and availability of the device.
Critical Impact
An authenticated local user can escalate privileges through the VAPIX service account D-Bus API and gain full control of the affected Axis device.
Affected Products
- Axis AXIS OS (active track)
- Axis AXIS OS 2024 (LTS track)
- Devices exposing the VAPIX Device Configuration framework via the D-Bus API
Discovery Timeline
- 2025-03-04 - CVE-2025-0360 published to the National Vulnerability Database
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-0360
Vulnerability Analysis
The vulnerability resides in the VAPIX Device Configuration framework, which mediates access to configuration operations on Axis devices. The framework interacts with a service account exposed over the D-Bus inter-process communication (IPC) channel. The flaw causes the framework to associate an incorrect privilege level with a caller when handling requests routed through the VAPIX service account D-Bus API.
Because the D-Bus API is available locally on the device, an authenticated user with limited rights can invoke operations that should be restricted to higher-privileged roles. The mismatch between the intended and enforced authorization model allows the caller to influence configuration and runtime state beyond their assigned role. Axis classifies the issue under CWE-863: Incorrect Authorization.
Root Cause
The root cause is an incorrect authorization decision inside the VAPIX Device Configuration framework. The framework fails to consistently validate the effective privilege level of the caller when a request transits the VAPIX service account D-Bus API. As a result, a lower-privileged authenticated user is treated as if operating with elevated rights.
Attack Vector
Exploitation requires local access to the device and prior authentication with low privileges. No user interaction is required. An attacker with a foothold on the device — for example, through valid credentials for a viewer or operator account, or through another local vector — can invoke the affected D-Bus interface to obtain elevated access. Refer to the Axis Security Advisory CVE-2025-0360 for technical details.
Detection Methods for CVE-2025-0360
Indicators of Compromise
- Unexpected configuration changes on AXIS OS devices made by low-privileged accounts.
- New or modified administrator accounts, firmware settings, or network parameters without a corresponding change ticket.
- Anomalous local sessions or API calls targeting the VAPIX Device Configuration endpoints.
Detection Strategies
- Review AXIS OS device logs for privilege-sensitive VAPIX operations executed by non-administrative users.
- Correlate authentication events with subsequent configuration-changing API calls to identify role mismatches.
- Baseline expected VAPIX API usage per account role and alert on deviations.
Monitoring Recommendations
- Forward AXIS OS syslog and audit events to a centralized logging or SIEM platform for retention and analysis.
- Monitor network segments hosting Axis devices for lateral movement attempts originating from cameras or encoders.
- Track firmware versions across the Axis fleet to confirm patched builds are deployed and remain in place.
How to Mitigate CVE-2025-0360
Immediate Actions Required
- Apply the AXIS OS firmware updates referenced in the Axis Security Advisory CVE-2025-0360 to active and 2024 LTS tracks.
- Audit local accounts on affected devices and remove unused or shared credentials.
- Restrict management access to Axis devices to trusted administrative networks only.
Patch Information
Axis Communications has published patched firmware for both the active AXIS OS track and the AXIS OS 2024 LTS track. Consult the Axis Security Advisory CVE-2025-0360 for the specific fixed versions applicable to each device model and firmware branch.
Workarounds
- Limit device access to administrative users only until firmware updates can be applied.
- Place Axis devices on a dedicated management VLAN with strict access control lists.
- Enforce strong, unique credentials for every account with local access to AXIS OS.
- Disable unused services and interfaces on affected devices to reduce local attack surface.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
