CVE-2025-0361: Axis OS Information Disclosure Vulnerability

CVE-2025-0361 Overview

CVE-2025-0361 is an unauthenticated username enumeration vulnerability in the VAPIX Device Configuration framework used by Axis Communications network devices. The flaw resides in the SSH Management API and allows a remote, unauthenticated attacker to determine whether a given username exists on the device. Truesec discovered the issue during an annual penetration test performed on behalf of Axis Communications. The weakness is classified as [CWE-203] Observable Discrepancy, meaning the API returns distinguishable responses for valid and invalid usernames. Successful exploitation exposes account information that supports downstream attacks such as password spraying and targeted brute-force campaigns against axis_os and axis_os_2024 devices.

Critical Impact
Unauthenticated attackers reachable over the network can enumerate valid usernames on Axis devices via the VAPIX SSH Management API, enabling reconnaissance for credential-based attacks.

Affected Products

Axis OS (active track) — axis:axis_os
Axis OS 2024 (LTS track) — axis:axis_os_2024
Axis network devices exposing the VAPIX Device Configuration SSH Management API

Discovery Timeline

Vulnerability discovered by Truesec during an annual penetration test conducted on behalf of Axis Communications
2025-04-08 - CVE-2025-0361 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-0361

Vulnerability Analysis

The VAPIX Device Configuration framework exposes an SSH Management API used to administer SSH access on Axis devices. The endpoint responds differently depending on whether the supplied username corresponds to an existing account. An attacker can send crafted requests iterating candidate usernames and infer account existence from the observable difference in responses. The vulnerability requires no authentication and no user interaction, and it is reachable over the network on devices exposing the VAPIX interface. While the flaw does not directly expose credentials or grant code execution, it provides account existence information that materially reduces the effort required for follow-on brute-force or credential-stuffing attacks against SSH.

Root Cause

The root cause is an observable discrepancy in the API's handling of valid versus invalid usernames. The SSH Management API returns distinguishable output (such as differing status codes, error messages, or response timing) that leaks account existence. This is a classic information exposure through discrepancy pattern documented as [CWE-203].

Attack Vector

An unauthenticated attacker with network access to the VAPIX Device Configuration interface issues repeated requests against the SSH Management API. By comparing responses, the attacker builds a list of valid local accounts on the target Axis device. Refer to the Axis Security Advisory CVE-2025-0361 for vendor technical details.

Detection Methods for CVE-2025-0361

Indicators of Compromise

High volume of requests from a single source to the VAPIX Device Configuration SSH Management API endpoint on Axis devices
Repeated unauthenticated API calls that vary only in the username parameter
Bursts of SSH authentication failures targeting a small set of usernames shortly after enumeration activity

Detection Strategies

Monitor Axis device access logs for iterative requests to the VAPIX SSH Management API from untrusted sources
Alert on unauthenticated VAPIX API traffic originating from outside management VLANs or jump hosts
Correlate enumeration-style API patterns with subsequent SSH login attempts using the same usernames

Monitoring Recommendations

Forward Axis device syslog and VAPIX API access logs to a centralized log platform for retention and analysis
Baseline normal VAPIX API usage per source IP and alert on statistical deviations
Track SSH authentication attempt volumes on Axis devices and flag unusual username churn

How to Mitigate CVE-2025-0361

Immediate Actions Required

Upgrade affected Axis devices to firmware versions listed as fixed in the Axis security advisory for both the active and 2024 LTS tracks
Restrict network reachability of the VAPIX Device Configuration interface to trusted management networks only
Audit local accounts on Axis devices and remove or rename predictable usernames where feasible
Enforce strong, unique passwords and rate limiting on SSH to blunt post-enumeration brute-force attempts

Patch Information

Axis Communications has published fixed firmware for both the axis_os active track and the axis_os_2024 LTS track. Consult the Axis Security Advisory CVE-2025-0361 for the exact firmware build numbers applicable to each device model and apply the update through the standard Axis firmware management workflow.

Workarounds

Place Axis devices behind a management VLAN or VPN and block VAPIX access from untrusted networks at the perimeter firewall
Disable the SSH service on devices that do not require it, reducing the value of any enumerated usernames
Apply IP allow-listing on the device or upstream network appliance so only administrative hosts can reach the VAPIX interface

bash

# Example: restrict VAPIX/SSH access to a management subnet using an upstream firewall
# Replace 10.10.0.0/24 with your management network and <axis_device_ip> accordingly
iptables -A FORWARD -s 10.10.0.0/24 -d <axis_device_ip> -p tcp --dport 443 -j ACCEPT
iptables -A FORWARD -s 10.10.0.0/24 -d <axis_device_ip> -p tcp --dport 22  -j ACCEPT
iptables -A FORWARD -d <axis_device_ip> -p tcp --dport 443 -j DROP
iptables -A FORWARD -d <axis_device_ip> -p tcp --dport 22  -j DROP