PT-2025-29200 · Apache · Apache Http Server

Noam Moshe · CVE-2025-30023 · Published 2025-07-11 · Updated 2026-01-23

Positive Technologies (AI Summary)

CVSS v3.1

9.0

Critical

Base vector

AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Axis Video Management Software (affected versions not specified)

Description The communication protocol used between the client and server has a flaw that could allow an authenticated user to perform a remote code execution attack. The issue involves improper serialized data handling between the client and server, enabling attackers to execute code without user interaction, which is suitable for lateral movement within a network.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

BDU:2025-11338

CVE-2025-30023

Affected Products

Apache Http Server

References · 21

• https://axis.com/dam/public/9b/a5/72/cve-2025-30023pdf-en-US-485733.pdf · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-11338 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-30023 · Security Note
• https://osv.dev/vulnerability/CVE-2025-30023 · Vendor Advisory
• https://t.me/cveNotify/149757 · Telegram Post
• https://t.me/pentestingnews/64401 · Telegram Post
• https://t.me/true_secator/7311 · Telegram Post
• https://twitter.com/cybrhoodsentinl/status/1953526618518942052 · Twitter Post
• https://t.me/NeKaspersky/4578 · Telegram Post
• https://twitter.com/zoomeye_team/status/1944707064049336564 · Twitter Post
• https://twitter.com/the_yellow_fall/status/1944575040265363939 · Twitter Post
• https://t.me/cvenotify/128493 · Telegram Post
• https://twitter.com/labrat_io/status/1955953385158443315 · Twitter Post
• https://reddit.com/r/sysadmin/comments/1mtt93k/patch_your_axis_camera_station_servers_especially · Reddit Post
• https://t.me/cvetracker/27532 · Telegram Post