CVE-2025-30025: Axis Camera Station Pro Privilege Escalation

CVE-2025-30025 Overview

CVE-2025-30025 is a local privilege escalation vulnerability affecting Axis Camera Station Pro and Axis Device Manager. The flaw exists in the communication protocol used between the server process and the service control component. A local, authenticated attacker can abuse this inter-process communication (IPC) channel to elevate privileges on the host running the vulnerable software. The vulnerability is tracked under CWE-502: Deserialization of Untrusted Data. Axis has published an advisory describing the issue and providing fixed versions in the Axis CVE-2025-30025 Advisory.

Critical Impact
A local user with low privileges can escalate to the privilege level of the vulnerable service, gaining elevated access to camera management infrastructure.

Affected Products

Axis Camera Station Pro
Axis Device Manager
Deployments running the affected server and service control components on Windows hosts

Discovery Timeline

2025-07-11 - CVE-2025-30025 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-30025

Vulnerability Analysis

Axis Camera Station Pro and Axis Device Manager run a privileged server process alongside a service control component. These components exchange messages over a local inter-process communication channel. The protocol between them contains a flaw that allows a local attacker to influence data processed by the higher-privileged endpoint.

Because the weakness is classified under [CWE-502], the server or service control component deserializes attacker-influenced data without sufficient validation. The result is that a lower-privileged local user can craft messages that the privileged component acts on, leading to code execution or configuration changes in the security context of the service.

Exploitation requires local access and low privileges on the affected host. It does not require user interaction. Successful exploitation impacts confidentiality, integrity, and availability of the Axis management software and any downstream cameras it controls.

Root Cause

The root cause is insecure design of the IPC protocol between the server process and the service control. The channel accepts and processes serialized data from local endpoints without adequate authentication, integrity checks, or type restrictions on deserialized objects. This allows an attacker with a local foothold to submit crafted messages that the privileged process trusts.

Attack Vector

An attacker must already have local, low-privileged access to the machine hosting Axis Camera Station Pro or Axis Device Manager. The attacker connects to the local IPC endpoint used by the service control channel and submits crafted messages. The vulnerable component parses these messages and executes actions or restores objects at its own elevated privilege level. Refer to the Axis CVE-2025-30025 Advisory for vendor-provided technical details.

Detection Methods for CVE-2025-30025

Indicators of Compromise

Unexpected child processes spawned by the Axis Camera Station Pro or Axis Device Manager service accounts.
New or modified files under the Axis installation directory created by non-administrative users.
Unusual local connections to the IPC endpoints exposed by the Axis server and service control components.
Service restarts or crashes correlated with low-privileged user activity on the host.

Detection Strategies

Monitor process lineage for the Axis server and service control processes to identify unexpected descendants running with elevated privileges.
Baseline the set of users and processes that normally interact with Axis local IPC endpoints and alert on deviations.
Track configuration changes to Axis Camera Station Pro that are not initiated through the sanctioned management console.

Monitoring Recommendations

Enable Windows process creation auditing (Event ID 4688) and command-line logging on hosts running Axis management software.
Forward endpoint telemetry to a centralized analytics platform for correlation of local privilege escalation patterns.
Alert on invocations of cmd.exe, powershell.exe, or script interpreters spawned by the Axis service account.

How to Mitigate CVE-2025-30025

Immediate Actions Required

Apply the fixed versions of Axis Camera Station Pro and Axis Device Manager listed in the Axis CVE-2025-30025 Advisory.
Restrict interactive and remote logon rights on hosts running the affected software to trusted administrators only.
Review local accounts and service accounts on Axis management servers and remove unnecessary users.
Audit recent activity on Axis management hosts for signs of privilege escalation attempts.

Patch Information

Axis has published fixed builds of Camera Station Pro and Device Manager. Consult the Axis CVE-2025-30025 Advisory for the specific patched versions and upgrade instructions. Upgrading is the recommended remediation because the fix modifies the IPC protocol behavior itself.

Workarounds

Limit access to servers hosting Axis Camera Station Pro and Axis Device Manager to a minimal set of administrative users until the patch is deployed.
Segment Axis management hosts on a dedicated administrative network to reduce the pool of accounts that can obtain local access.
Disable or remove Axis Device Manager on hosts where it is not actively required.

bash

# Example: restrict interactive logon to administrators on Windows host running Axis software
# Review current members of the local Users group
net localgroup Users

# Remove non-administrative accounts that do not require local access
net localgroup Users <lowpriv_account> /delete