A malicious ACAP application can gain access to admin-level service account credentials used by legitimate ACAP applications, leading to…
Axis·CWE-214·Published 2025-11-11
A malicious ACAP application can gain access to admin-level service account credentials used by legitimate ACAP applications, leading to potential privilege escalation of the malicious ACAP application. This vulnerability can only be exploited if the Axis device is configured to allow the installation of unsigned ACAP applications, and if an attacker convinces the victim to install a malicious ACAP application.
A malicious ACAP application can gain access to admin-level service account credentials used by legitimate ACAP applications, leading to potential privilege escalation of the malicious ACAP application. This vulnerability can only be exploited if the Axis device is configured to allow the installation of unsigned ACAP applications, and if an attacker convinces the victim to install a malicious ACAP application.
Una aplicación ACAP maliciosa puede obtener acceso a las credenciales de cuenta de servicio de nivel de administrador utilizadas por aplicaciones ACAP legítimas, lo que lleva a una posible escalada de privilegios de la aplicación ACAP maliciosa. Esta vulnerabilidad solo puede ser explotada si el dispositivo Axis está configurado para permitir la instalación de aplicaciones ACAP sin firmar, y si un atacante convence a la víctima de instalar una aplicación ACAP maliciosa.
| Version | Type | Source | Base | Exp | Impact | Vector |
|---|---|---|---|---|---|---|
| 3.1 | Primary | cve.org | 6.6 | — | — | CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H |
| 3.1 | Primary | NVD | 6.6 | 0.7 | 5.9 | CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H |
| 3.1 | Secondary | NVD | 6.6 | 0.7 | 5.9 | CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H |