Vulnerability · Published Feb 10, 2026 · Assigned by Axis
CVE-2025-11142
High 7.1
In plain English
A high-severity OS command injection in AXIS OS from Axis Communications AB. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 47% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.
Severity (CVSS 3.1)7.1High
Exploit odds (30 days)0.6%top 53.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack tooling1Public PoC
Official description
The VAPIX API mediaclip.cgi that did not have a sufficient input validation allowing for a possible remote code execution. This flaw can only be exploited after authenticating with an operator- or administrator- privileged service account.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Axis Communications AB | AXIS OS | 12.6.54 – through 12.7.35 |
Weakness: CWE-78 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H