CVE-2025-30024: Axis Device Manager MitM Vulnerability

CVE-2025-30024 Overview

CVE-2025-30024 is a certificate validation flaw [CWE-295] in the communication protocol used between the Axis Device Manager client and server. An attacker positioned on the network path can leverage the flaw to execute a man-in-the-middle (MITM) attack. Successful exploitation compromises the confidentiality and integrity of data exchanged between the client and server components.

The issue affects Axis Device Manager, a Windows-based tool used to configure and manage Axis network video products at scale. Axis published a security advisory documenting the flaw and its remediation.

Critical Impact
An attacker on the communication path can intercept and modify traffic between the Axis Device Manager client and server, exposing device credentials and management operations to tampering.

Affected Products

Axis Device Manager (see vendor advisory for affected versions)
Deployments using the client-server communication protocol with the vulnerable certificate validation logic
Any Axis network video installation managed through the affected client-server pair

Discovery Timeline

2025-07-11 - CVE-2025-30024 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-30024

Vulnerability Analysis

The vulnerability resides in the protocol used for client-server communication in Axis Device Manager. The protocol does not perform sufficient validation of the peer's identity, categorized under improper certificate validation [CWE-295]. An attacker able to intercept traffic between client and server can present forged or substituted credentials that the peer accepts as legitimate.

Once the MITM position is established, the attacker can read management traffic and inject modified commands. Impacted operations may include device provisioning, firmware updates, credential distribution, and configuration changes pushed to managed Axis devices. The EPSS score is 0.346 percent, indicating low observed exploitation activity to date, but the technical impact on managed device fleets is significant.

Exploitation requires the attacker to occupy a network position between client and server and to induce user interaction, such as initiating a management session. Attack complexity is elevated because the adversary must reliably intercept and manipulate the specific protocol exchange.

Root Cause

The root cause is improper certificate validation in the communication protocol between the Axis Device Manager client and the server. The peer's certificate chain, hostname, or trust anchor is not verified strictly enough to prevent substitution by an on-path attacker.

Attack Vector

The attack vector is network-based and requires user interaction. An adversary with the ability to intercept traffic, through ARP spoofing, rogue DHCP, DNS manipulation, or compromised network infrastructure, positions themselves between the client and server. When an operator connects the client to the server, the attacker terminates the session on both sides and relays traffic while observing or modifying content.

Refer to the Axis Security Advisory CVE-2025-30024 for protocol-level details and fixed version information.

Detection Methods for CVE-2025-30024

Indicators of Compromise

Unexpected TLS or certificate warnings displayed by the Axis Device Manager client when connecting to a known server
Axis Device Manager sessions originating from or terminating at IP addresses that do not match documented server endpoints
Unexplained configuration changes, firmware rollbacks, or credential resets across managed Axis devices
ARP table anomalies or duplicate MAC addresses on network segments carrying management traffic

Detection Strategies

Baseline the expected client-server communication endpoints and alert on connections deviating from that baseline
Inspect certificate fingerprints presented to Axis Device Manager clients and flag changes that do not correspond to a documented certificate rotation
Correlate Windows event logs from Axis Device Manager hosts with network flow data to identify sessions relayed through unexpected intermediaries

Monitoring Recommendations

Monitor the management VLAN for ARP spoofing, rogue DHCP responses, and unauthorized layer-2 devices
Log and review all administrative actions performed through Axis Device Manager, including firmware pushes and credential changes
Alert on Axis Device Manager client connections initiated from unusual workstations or outside standard change windows

How to Mitigate CVE-2025-30024

Immediate Actions Required

Apply the fixed version of Axis Device Manager as documented in the vendor advisory
Restrict Axis Device Manager client-server traffic to a dedicated, segmented management network
Rotate credentials used by Axis Device Manager to manage devices after patching, in case they were exposed
Audit recent management actions for signs of unauthorized configuration or firmware changes

Patch Information

Axis has published a security advisory with remediation details. Consult the Axis Security Advisory CVE-2025-30024 for the fixed release version and upgrade instructions. Upgrade all client and server components to the fixed version simultaneously to avoid protocol mismatches.

Workarounds

Isolate the Axis Device Manager server and clients on a dedicated management network with strict access control lists
Enforce port security, DHCP snooping, and dynamic ARP inspection on switches carrying management traffic to reduce MITM opportunities
Require operators to connect from hardened jump hosts rather than general-purpose workstations
Verify server certificate fingerprints out-of-band before initiating administrative sessions until patched

bash

# Example: restrict Axis Device Manager traffic to a management subnet using Windows Defender Firewall
netsh advfirewall firewall add rule name="AxisDM-Client-Allow" ^
  dir=out action=allow protocol=TCP remoteip=10.10.50.0/24 ^
  program="C:\Program Files\Axis Communications\AXIS Device Manager\AxisDeviceManager.exe"

netsh advfirewall firewall add rule name="AxisDM-Block-Other" ^
  dir=out action=block ^
  program="C:\Program Files\Axis Communications\AXIS Device Manager\AxisDeviceManager.exe"