Arbitrary Value Injection in Axis Guard Tour API
CVE-2025-0325

4.3MEDIUM

Key Information:

Vendor

Axis Communications Ab

Status
Axis Os
Vendor
CVE Published:
2 June 2025

What is CVE-2025-0325?

The Guard Tour VAPIX API provided by Axis Communications contains a vulnerability that allows attackers to use arbitrary parameter values. This improper handling can be exploited to prevent legitimate users from accessing the guard tour configuration page through the web interface, effectively disrupting the intended functionality and management of security protocols.

Affected Version(s)

AXIS OS 6.50.0 < 6.50.5.21

AXIS OS 7.0.0 < 8.40.74

AXIS OS 9.0.0 < 9.80.100

References

https://www.axis.com/dam/public/d0/ae/fe/cve-2025-0325pdf...

CVSS V3.1

Score:
4.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

51l3nc3
.