2 lines
2.8 KiB
JSON
2 lines
2.8 KiB
JSON
{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"AXIS OS","vendor":"Axis Communications AB","versions":[{"lessThan":"12.4.0","status":"affected","version":"12.0.0","versionType":"semver"}]}],"source":"product-security@axis.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:axis:axis_os:*:*:*:*:active:*:*:*","matchCriteriaId":"E0A21C83-8FA2-4F43-A929-3F0DCD9DF99C","versionEndExcluding":"12.4.0","versionStartIncluding":"12.0.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"During an annual penetration test conducted on behalf of Axis Communication, Truesec discovered a flaw in the VAPIX Device Configuration framework that allowed a privilege escalation, enabling a lower-privileged user to gain administrator privileges."},{"lang":"es","value":"Durante una prueba de penetración anual realizada en nombre de Axis Communication, Truesec descubrió una falla en el marco de configuración del dispositivo VAPIX que permitía una escalada de privilegios, lo que permitió que un usuario con menores privilegios obtuviera privilegios de administrador."}],"id":"CVE-2025-0358","lastModified":"2026-06-17T08:26:20.643","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.0,"impactScore":6.0,"source":"product-security@axis.com","type":"Secondary"},{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2025-0358","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2025-06-02T12:57:14.948215Z","version":"2.0.3"}}]},"published":"2025-06-02T08:15:20.917","references":[{"source":"product-security@axis.com","tags":["Vendor Advisory"],"url":"https://www.axis.com/dam/public/35/90/85/cve-2025-0358pdf-en-US-483809.pdf"}],"sourceIdentifier":"product-security@axis.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-269"}],"source":"product-security@axis.com","type":"Secondary"},{"description":[{"lang":"en","value":"NVD-CWE-noinfo"}],"source":"nvd@nist.gov","type":"Primary"}]}
|