CVE-2025-10226: Axxon One Privilege Escalation Flaw

CVE-2025-10226 Overview

CVE-2025-10226 is a critical vulnerability affecting AxxonSoft Axxon One (C-Werk) version 2.0.8 and earlier. The vulnerability stems from the application's dependency on a vulnerable third-party component—specifically PostgreSQL v10.x—which contains multiple known security flaws that have been resolved in PostgreSQL 17.4. This dependency on vulnerable third-party components (CWE-1395) allows remote attackers to escalate privileges, execute arbitrary code, or cause denial-of-service conditions on affected systems running Windows or Linux.

Critical Impact

Remote attackers can exploit known PostgreSQL v10.x vulnerabilities to achieve privilege escalation, arbitrary code execution, or denial-of-service on Axxon One installations without authentication.

Affected Products

• AxxonSoft Axxon One (C-Werk) 2.0.8 and earlier versions
• Systems running on Microsoft Windows
• Systems running on Linux

Discovery Timeline

• 2025-09-10 - CVE-2025-10226 published to NVD
• 2025-12-19 - Last updated in NVD database

Technical Details for CVE-2025-10226

Vulnerability Analysis

This vulnerability represents a supply chain security risk where AxxonSoft Axxon One relies on an outdated and vulnerable version of PostgreSQL (v10.x) as its database backend. PostgreSQL 10.x reached end-of-life status and contains numerous unpatched security vulnerabilities that have been addressed in newer releases, particularly PostgreSQL 17.4.

The attack surface is network-accessible, requiring no authentication or user interaction to exploit. Successful exploitation can result in complete compromise of confidentiality, integrity, and availability of the affected system. The vulnerability affects the database layer of the video management system, which is critical infrastructure for security and surveillance operations.

Root Cause

The root cause of CVE-2025-10226 is the use of PostgreSQL v10.x, a database version that has accumulated multiple known security vulnerabilities over time. Instead of maintaining an updated dependency, Axxon One continued shipping with this vulnerable component, inheriting all security flaws present in the outdated PostgreSQL version. This represents a failure in software composition analysis and dependency management practices.

Attack Vector

The attack leverages the network-accessible nature of the PostgreSQL backend. Since multiple CVEs exist in PostgreSQL v10.x, attackers have various exploitation paths available:

1. Remote Code Execution: Attackers can exploit PostgreSQL vulnerabilities to execute arbitrary commands on the underlying system with the privileges of the database process
2. Privilege Escalation: Database-level exploits can be chained to escalate privileges beyond the database context
3. Denial of Service: Resource exhaustion or crash-inducing exploits can disrupt the availability of the Axxon One video management system

The vulnerability does not require authentication, meaning any network-accessible deployment is at risk from unauthenticated attackers.

Detection Methods for CVE-2025-10226

Indicators of Compromise

• Unusual PostgreSQL process behavior or unexpected child processes spawned by the database service
• Anomalous network connections originating from the PostgreSQL backend to external IP addresses
• Unexpected database queries or administrative commands in PostgreSQL logs
• System resource exhaustion tied to PostgreSQL processes
• Unauthorized privilege changes or new user accounts created through database exploitation

Detection Strategies

• Monitor PostgreSQL logs for exploitation attempts targeting known CVEs in version 10.x
• Implement network segmentation and monitor traffic to/from the Axxon One PostgreSQL backend
• Deploy intrusion detection rules for known PostgreSQL exploitation patterns
• Utilize SentinelOne Singularity Platform to detect anomalous process behavior and post-exploitation activities
• Conduct regular vulnerability scanning to identify systems running affected Axxon One versions

Monitoring Recommendations

• Enable verbose logging on PostgreSQL instances and forward logs to a centralized SIEM
• Monitor for unexpected database administrative operations and privilege changes
• Track network connections from database processes for command-and-control indicators
• Implement file integrity monitoring on PostgreSQL binaries and configuration files
• Alert on any process execution chains originating from database services

How to Mitigate CVE-2025-10226

Immediate Actions Required

• Identify all deployments of AxxonSoft Axxon One version 2.0.8 and earlier in your environment
• Restrict network access to the PostgreSQL backend using firewall rules and network segmentation
• Implement strict access controls to limit who can connect to the database service
• Monitor affected systems closely for signs of exploitation while awaiting vendor patches
• Review and apply any available updates from AxxonSoft through their security advisory portal

Patch Information

AxxonSoft has published security information regarding this vulnerability. Organizations should consult the AxxonSoft Security Advisories page for the latest patch availability and upgrade guidance. The underlying PostgreSQL vulnerabilities are resolved in PostgreSQL 17.4, suggesting that a significant version upgrade of the database component is required.

For technical details on the specific PostgreSQL vulnerabilities being inherited, refer to the PostgreSQL Release Documentation.

Workarounds

• Isolate Axxon One systems from untrusted networks by placing them behind VPNs or internal network segments
• Implement application-layer firewalls to restrict and monitor PostgreSQL protocol traffic
• Disable unnecessary PostgreSQL features and extensions that may expand the attack surface
• Deploy database activity monitoring to detect and alert on suspicious queries or operations
• Consider temporary service isolation if patches are not immediately available and the risk is deemed unacceptable

# Example: Restrict PostgreSQL network access using iptables (Linux)
# Allow connections only from trusted application servers
iptables -A INPUT -p tcp --dport 5432 -s 10.0.1.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 5432 -j DROP

# Enable PostgreSQL logging for security monitoring
# Edit postgresql.conf and add:
# log_connections = on
# log_disconnections = on
# log_statement = 'all'