Command Injection Vulnerability in Axis Devices via ACAP Configuration File

CVE-2025-6779

What is CVE-2025-6779?

This vulnerability stems from improper permissions in the ACAP configuration file of Axis devices, which could enable command injection attacks. If an attacker is able to convince a victim to install a malicious ACAP application, they may exploit this oversight to gain unauthorized access and escalate their privileges. The issue presents a heightened risk if the device is configured to accept unsigned ACAP applications, exposing users to potential security breaches. It is crucial for users to rigorously assess their device settings and installation practices to mitigate this risk.

References