PT-2025-46307 · Axis Communications · Acap Applications

Keanesec · Published 2025-11-11 · Updated 2026-01-21 · CVE-2025-6298

Positive Technologies (AI Summary)

CVSS v3.1

6.7

Medium

Base vector

AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Axis Communications ACAP applications (affected versions not specified)

Description ACAP applications may be able to gain elevated privileges due to improper input validation, which could lead to privilege escalation. This is only possible if the Axis device allows the installation of unsigned ACAP applications and an attacker convinces a user to install a malicious ACAP application.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

LPE

Weakness Enumeration

CWE-1287

Related Identifiers

CVE-2025-6298

Affected Products

Acap Applications

References · 7

• https://axis.com/dam/public/ef/91/c3/cve-2025-6298pdf-en-US-504215.pdf · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-6298 · Security Note
• https://osv.dev/vulnerability/CVE-2025-6298 · Vendor Advisory
• https://t.me/cveNotify/142383 · Telegram Post
• https://t.me/cveNotify/149458 · Telegram Post
• https://t.me/CVEtracker/37009 · Telegram Post
• https://twitter.com/CVEnew/status/1988143829535351161 · Twitter Post