Arbitrary Code Execution Vulnerability in Axis Devices

CVE-2025-4645

What is CVE-2025-4645?

This vulnerability arises from an insufficient input validation in the ACAP configuration file, potentially allowing attackers to execute arbitrary code on affected Axis devices. For this exploit to succeed, the device must be configured to permit the installation of unsigned ACAP applications, and an attacker must persuade the target user to install a compromised application. It highlights the importance of strict input validation and the need for secure installation practices to mitigate risks associated with this vulnerability.

References