CVE-2025-5452: Axis OS Privilege Escalation Vulnerability

CVE-2025-5452 Overview

CVE-2025-5452 is a privilege escalation vulnerability affecting Axis Communications devices running Axis OS. A malicious AXIS Camera Application Platform (ACAP) application can obtain admin-level service account credentials that legitimate ACAP applications use on the device. Once the credentials are captured, the malicious application inherits administrative privileges on the Axis device.

The issue is classified as an Exposure of Sensitive Information to an Unauthorized Actor [CWE-214]. Exploitation requires the Axis device to be configured to allow installation of unsigned ACAP applications, and a victim must be convinced to install the malicious application. More than 200 Axis camera, encoder, access control, audio, and body-worn product models are listed as affected.

Critical Impact
A malicious unsigned ACAP application can harvest admin service account credentials belonging to trusted ACAP applications, granting the attacker administrative control over the Axis device.

Affected Products

Axis OS (all variants listed in the Axis advisory)
Axis network cameras across the C, D, F, M, P, Q, and V series (for example, P3268-LVE, Q1656, Q6135-LE, M3086-V)
Axis access control, audio, radar, and body-worn devices (for example, A1610-B, C1410 Mk II, D2110-VE, W110)

Discovery Timeline

2025-11-11 - CVE-2025-5452 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-5452

Vulnerability Analysis

Axis devices support the ACAP framework, which lets third-party applications run directly on the camera or controller. Legitimate ACAP applications frequently need administrative access to on-device services, so they authenticate using service account credentials provisioned at install time.

The vulnerability allows a co-resident malicious ACAP application to read or otherwise access the admin-level service account credentials used by other ACAP applications on the same device. With those credentials in hand, the attacker's application can invoke privileged APIs, alter device configuration, view or manipulate video streams, and pivot deeper into the surveillance environment.

Exploitation depends on two preconditions. First, the device must be configured to permit installation of unsigned ACAP applications, which disables the vendor signature check that normally gates untrusted code. Second, the attacker must convince an operator with install rights to deploy the malicious application, typically through social engineering or a supply-chain lure.

Root Cause

The root cause is insufficient isolation of credential material between ACAP applications. Admin service account credentials issued to trusted ACAP applications are reachable by another ACAP application executing on the same device, which violates the intended trust boundary between installed applications.

Attack Vector

The attack vector is network-adjacent installation of a crafted ACAP package. An attacker packages a malicious .eap ACAP application, delivers it to an operator, and relies on the device's "allow unsigned apps" setting to complete installation. Once running, the application enumerates and exfiltrates credentials belonging to legitimate ACAP applications, then reuses them against local admin-scoped APIs.

No verified public exploit or proof-of-concept code is available for this issue. The vulnerability mechanism is described in prose only, in line with the vendor advisory.

Detection Methods for CVE-2025-5452

Indicators of Compromise

Installation of unsigned ACAP applications on Axis devices, especially applications from sources outside the Axis partner ecosystem.
Unexpected changes to device configuration, user accounts, or firmware settings following an ACAP install event.
Authentication events on admin-level service accounts originating from ACAP contexts that do not correspond to the owning application's normal behavior.

Detection Strategies

Inventory all Axis devices and identify those with the "Allow unsigned apps" option enabled; treat that setting as a high-priority audit finding.
Compare the installed ACAP application list against an approved baseline and alert on unknown packages.
Correlate Axis device syslog and audit events for ACAP install, uninstall, and privileged API calls with the responsible application identity.

Monitoring Recommendations

Forward Axis device logs to a centralized logging or SIEM platform and build alerts for ACAP lifecycle events and admin credential use.
Monitor network traffic from cameras for anomalous outbound connections that may indicate credential exfiltration or command and control.
Track firmware version and configuration drift on Axis devices as part of routine operational technology monitoring.

How to Mitigate CVE-2025-5452

Immediate Actions Required

Apply the patched Axis OS release for each affected device model, as listed in the Axis security advisory.
Disable installation of unsigned ACAP applications on every Axis device unless there is an explicit, documented business need.
Audit currently installed ACAP applications and remove any that are unsigned, unknown, or no longer required.
Rotate credentials and review privileged accounts on devices where untrusted ACAP applications may have executed.

Patch Information

Axis Communications has published a security advisory with the fixed Axis OS versions per affected product. Refer to the Axis Security Advisory CVE-2025-5452 for the authoritative list of impacted models and the corresponding remediated firmware releases.

Workarounds

Enforce the default policy that requires ACAP applications to be signed by a trusted publisher before installation.
Restrict device administrative access to a small set of authenticated operators and require change control for any ACAP deployment.
Segment Axis devices onto a dedicated VLAN with strict egress filtering to limit the blast radius if credentials are stolen.
Limit physical and management-plane access to Axis devices so that unsigned ACAP applications cannot be sideloaded by unauthorized personnel.

bash

# Configuration example: verify signed-app enforcement via the Axis VAPI
# Query current unsigned-app policy (replace <device> and credentials)
curl -u "admin:<password>" --digest \
  "https://<device>/axis-cgi/param.cgi?action=list&group=Network.SSH,Properties.EmbeddedDevelopment"

# Disable unsigned ACAP installation (set AllowUnsignedPackages to no)
curl -u "admin:<password>" --digest \
  "https://<device>/axis-cgi/param.cgi?action=update&Properties.EmbeddedDevelopment.AllowUnsignedPackages=no"