CVE-2025-10220: Axxonsoft Axxon One RCE Vulnerability

CVE-2025-10220 Overview

CVE-2025-10220 is a critical vulnerability affecting AxxonSoft Axxon One VMS versions 2.0.0 through 2.0.4 on Windows systems. The vulnerability stems from the use of unmaintained third-party components (CWE-1104) in the NuGet dependency chain. This allows a remote attacker to execute arbitrary code or bypass security features by exploiting vulnerable third-party packages including Google.Protobuf, DynamicData, System.Runtime.CompilerServices.Unsafe, and others.

Critical Impact

Remote attackers can achieve arbitrary code execution or bypass security controls on affected video management systems without requiring authentication or user interaction.

Affected Products

• AxxonSoft Axxon One VMS 2.0.0
• AxxonSoft Axxon One VMS 2.0.1 through 2.0.3
• AxxonSoft Axxon One VMS 2.0.4

Discovery Timeline

• September 10, 2025 - CVE-2025-10220 published to NVD
• December 19, 2025 - Last updated in NVD database

Technical Details for CVE-2025-10220

Vulnerability Analysis

This vulnerability represents a supply chain security issue where the AxxonSoft Axxon One Video Management System incorporates multiple NuGet dependencies that are either unmaintained or contain known security vulnerabilities. The affected components include critical libraries such as Google.Protobuf for protocol buffer serialization, DynamicData for reactive data management, and System.Runtime.CompilerServices.Unsafe for low-level memory operations.

The use of vulnerable third-party packages creates multiple potential attack surfaces within the application. An attacker can leverage known vulnerabilities in these dependencies to compromise the host system, as the VMS software inherits all security weaknesses present in its dependency chain.

Root Cause

The root cause of CVE-2025-10220 is the inclusion of unmaintained or vulnerable third-party NuGet packages in the Axxon One VMS software distribution. Software composition analysis (SCA) failures during the development lifecycle allowed these vulnerable dependencies to be shipped with the product. The affected packages have not received security updates, leaving known vulnerabilities unpatched and exploitable.

Attack Vector

The vulnerability is exploitable remotely over the network without requiring authentication or user interaction. Attackers can target the exposed VMS services and exploit the underlying vulnerable libraries to achieve code execution. The attack surface is network-accessible, making this particularly dangerous for VMS deployments exposed to untrusted networks or the internet.

Since no verified code examples are available, the exploitation methodology depends on which specific vulnerable dependency is targeted. Attackers would typically identify the vulnerable library versions in use and leverage existing exploits or techniques documented for those specific CVEs affecting Google.Protobuf, DynamicData, or System.Runtime.CompilerServices.Unsafe. For detailed technical information, refer to the AxxonSoft Security Advisories.

Detection Methods for CVE-2025-10220

Indicators of Compromise

• Unexpected network connections originating from the Axxon One VMS process to unknown external hosts
• Anomalous child processes spawned by the VMS application that are not part of normal operations
• Unusual memory allocation patterns or crashes in the VMS service related to serialization operations
• Modifications to system files or registry entries initiated by the VMS process

Detection Strategies

• Implement software composition analysis (SCA) scanning to identify vulnerable NuGet package versions in deployed Axxon One installations
• Monitor for exploitation attempts targeting known vulnerabilities in Google.Protobuf, DynamicData, and System.Runtime.CompilerServices.Unsafe
• Deploy endpoint detection and response (EDR) solutions to identify suspicious behavior from the VMS application
• Review application logs for serialization errors or unexpected exception patterns that may indicate exploitation attempts

Monitoring Recommendations

• Enable detailed logging for the Axxon One VMS application and forward logs to a SIEM for correlation
• Monitor network traffic to and from VMS servers for anomalous patterns or connections to known malicious infrastructure
• Implement file integrity monitoring on VMS installation directories to detect unauthorized modifications
• Set up alerts for process creation events where the VMS process spawns unexpected child processes

How to Mitigate CVE-2025-10220

Immediate Actions Required

• Upgrade AxxonSoft Axxon One VMS to a patched version that addresses the vulnerable NuGet dependencies
• Isolate affected VMS systems from untrusted networks until patches can be applied
• Implement network segmentation to limit exposure of VMS services to only required clients
• Deploy web application firewalls (WAF) or intrusion prevention systems (IPS) with signatures for known dependency exploits

Patch Information

AxxonSoft has published information regarding this vulnerability. Administrators should consult the AxxonSoft Security Advisories for official patch availability and upgrade instructions. Ensure that any applied updates include remediated versions of the affected NuGet packages: Google.Protobuf, DynamicData, System.Runtime.CompilerServices.Unsafe, and other identified vulnerable components.

Workarounds

• Restrict network access to the Axxon One VMS to trusted IP addresses only using firewall rules
• Deploy the VMS behind a VPN to prevent direct exposure to untrusted networks
• Implement application-level access controls to limit who can interact with VMS services
• Consider deploying a reverse proxy with additional security controls in front of the VMS application

# Example: Restrict Axxon One VMS network access using Windows Firewall
# Block inbound connections except from trusted management subnet
netsh advfirewall firewall add rule name="Block Axxon One VMS Inbound" dir=in action=block program="C:\Program Files\AxxonSoft\Axxon One\*"
netsh advfirewall firewall add rule name="Allow Axxon One VMS Trusted" dir=in action=allow program="C:\Program Files\AxxonSoft\Axxon One\*" remoteip=10.0.0.0/24