AAxis Communications AB

Products

Exploited and recent CVEs

• CVE-2026-63286 High 7.1 Database backups are vulnerable to offline attacks. Backups created using a version prior to the patched version are still vulnerable. AXIS Camera Station Pro automatically creates one more such backu <0.1%
• CVE-2026-63286 High 7.1 Database backups are vulnerable to offline attacks. Backups created using a version prior to the patched version are still vulnerable. AXIS Camera Station Pro automatically creates one more such backu <0.1%
• CVE-2026-4757 High 7.2 A VAPIX API parameter had improper input validation which could allow code execution and potentially lead to a privilege escalation. This flaw can only be exploited after authenticating with an admini 0.6%
• CVE-2026-6505 Medium 5.1 The ACAP framework contains a Time-of-Check to Time-of-Use (TOCTOU) race condition, which could potentially lead to privilege escalation. This vulnerability can only be exploited if the Axis device is <0.1%
• CVE-2026-5304 Medium 5.7 An ACAP configuration file lacks input validation, which could potentially lead to privilege escalation. This vulnerability can only be exploited if the Axis device is configured to allow the installa 0.3%
• CVE-2026-5303 Medium 5.7 The ACAP framework contains a Time-of-Check to Time-of-Use (TOCTOU) race condition, which could potentially lead to privilege escalation. This vulnerability can only be exploited if the Axis device is 0.2%
• CVE-2026-8158 Medium 5.3 The Signed Video Framework contained a  buffer overflow issue which could lead the application using this framework to crash. The issue exclusively affects the tools used for the validation of signed 0.3%
• CVE-2026-8158 Medium 5.3 The Signed Video Framework contained a  buffer overflow issue which could lead the application using this framework to crash. The issue exclusively affects the tools used for the validation of signed 0.3%
• CVE-2026-8158 Medium 5.3 The Signed Video Framework contained a  buffer overflow issue which could lead the application using this framework to crash. The issue exclusively affects the tools used for the validation of signed 0.3%
• CVE-2026-6181 Medium 5.9 The Device Configuration Framework is vulnerable to an authentication bypass flaw. This flaw can only be exploited after authenticating with a viewer-privileged service account. 0.4%
• CVE-2026-1185 Medium 5.4 A configuration file on the local file system had improper input validation which could allow code execution and potentially lead to privilege escalation. This vulnerability can only be exploited if a 0.2%
• CVE-2026-0804 Medium 6.7 An ACAP configuration file lacked sufficient input validation, which could allow a path traversal attack leading to potential privilege escalation. This vulnerability can only be exploited if the Axis 0.1%
• CVE-2026-0802 Medium 6.0 An ACAP configuration file lacked sufficient input validation, which could allow command injection and potentially lead to privilege escalation. This vulnerability can only be exploited if the Axis de 0.4%
• CVE-2026-0541 Medium 6.7 ACAP applications can gain elevated privileges due to improper input validation during the installation process, potentially leading to privilege escalation. This vulnerability can only be exploited i <0.1%
• CVE-2025-12063 Medium 5.7 An insecure direct object reference allowed a non-admin user to modify or remove certain data objects without having the appropriate permissions. 0.2%
• CVE-2025-12757 Medium 4.6 An AXIS Camera Station Pro feature can be exploited in a way that allows a non-admin user to view information they are not permitted to. 0.2%
• CVE-2025-13064 Medium 4.5 A server-side injection was possible for a malicious admin to manipulate the application to include a malicious script which is executed by the server. This attack is only possible if the admin uses a 0.2%
• CVE-2025-11547 High 7.8 AXIS Camera Station Pro contained a flaw to perform a privilege escalation attack on the server as a non-admin user. 0.2%
• CVE-2025-11142 High 7.1 The VAPIX API mediaclip.cgi that did not have a sufficient input validation allowing for a possible remote code execution. This flaw can only be exploited after authenticating with an operator- or adm 0.6%
• CVE-2025-9055 Medium 6.4 The VAPIX Edge storage API that allowed a privilege escalation, enabling a VAPIX administrator-privileged user to gain Linux Root privileges. This flaw can only be exploited after authenticating with 0.1%
• CVE-2025-8998 Low 3.1 It was possible to upload files with a specific name to a temporary directory, which may result in process crashes and impact usability. This flaw can only be exploited after authenticating with an op 0.2%
• CVE-2025-9524 Medium 4.3 The VAPIX API port.cgi did not have sufficient input validation, which may result in process crashes and impact usability. This vulnerability can only be exploited after authenticating with a viewer- 0.3%
• CVE-2025-10714 High 8.4 AXIS Optimizer was vulnerable to an unquoted search path vulnerability, which could potentially lead to privilege escalation within Microsoft Windows operating system. This vulnerability can only be e 0.1%
• CVE-2025-8108 Medium 6.7 An ACAP configuration file has improper permissions and lacks input validation, which could potentially lead to privilege escalation. This vulnerability can only be exploited if the Axis device is con 0.1%
• CVE-2025-6779 Medium 6.7 An ACAP configuration file has improper permissions, which could allow command injection and potentially lead to privilege escalation. This vulnerability can only be exploited if the Axis device is co 1.0%
• CVE-2025-6571 Medium 6.0 A 3rd-party component exposed its password in process arguments, allowing for low-privileged users to access it. 0.1%
• CVE-2025-5452 Medium 6.6 A malicious ACAP application can gain access to admin-level service account credentials used by legitimate ACAP applications, leading to potential privilege escalation of the malicious ACAP applicatio 0.3%
• CVE-2025-6298 Medium 6.7 ACAP applications can gain elevated privileges due to improper input validation, potentially leading to privilege escalation. This vulnerability can only be exploited if the Axis device is configured 0.1%
• CVE-2025-5718 Medium 6.8 The ACAP Application framework could allow privilege escalation through a symlink attack. This vulnerability can only be exploited if the Axis device is configured to allow the installation of unsigne 0.4%
• CVE-2025-5454 Medium 6.4 An ACAP configuration file lacked sufficient input validation, which could allow a path traversal attack leading to potential privilege escalation. This vulnerability can only be exploited if the Axis 0.2%