NVD や CVE、ほか複数の脅威フィードを束ね、RCE など高リスクな事象を深く追える一覧です。CVSS と EPSS を組み合わせ、Exploit 参照や PoC の有無から悪用しやすさを追跡します。ベンダー修正や緩和策の文脈とあわせて優先度を決め、対応サイクルを短く保ちつつ重要資産を守る支援をします。
Assigner（CNA／発行元）：[email protected] この条件を外す
| CVE | 説明 | CVSS 最大値 | EPSS（%） | 公開 | 更新 |
|---|---|---|---|---|---|
| CVE-2025-4645 | An ACAP configuration file lacked sufficient input validation, which could allow for arbitrary code execution. This vulnerability can only be exploited if the Axis device is configured to allow the installation of unsigned ACAP applications, and if an attacker convinces the victim to install a malicious ACAP application. | 6.7 | 0.13% | 2025-11-11 | 2026-06-17 |
| CVE-2025-3892 | ACAP applications can be executed with elevated privileges, potentially leading to privilege escalation. This vulnerability can only be exploited if the Axis device is configured to allow the installation of unsigned ACAP applications, and if an attacker convinces the victim to install a malicious ACAP application. | 6.7 | 0.09% | 2025-08-12 | 2026-06-17 |
| CVE-2025-30027 | An ACAP configuration file lacked sufficient input validation, which could allow for arbitrary code execution. This vulnerability can only be exploited if the Axis device is configured to allow the installation of unsigned ACAP applications, and if an attacker convinces the victim to install a malicious ACAP application. | 6.7 | 0.16% | 2025-08-12 | 2026-06-17 |
| CVE-2025-7622 | During an internal security assessment, a Server-Side Request Forgery (SSRF) vulnerability that allowed an authenticated attacker to access internal resources on the server was discovered. | 5.1 | 0.15% | 2025-08-12 | 2026-06-17 |
| CVE-2025-30026 | The AXIS Camera Station Server had a flaw that allowed to bypass authentication that is normally required. | 5.3 | 0.60% | 2025-07-11 | 2026-06-17 |
| CVE-2025-30025 | The communication protocol used between the server process and the service control had a flaw that could lead to a local privilege escalation. | 4.8 | 0.20% | 2025-07-11 | 2026-06-17 |
| CVE-2025-30024 | The communication protocol used between client and server had a flaw that could be leveraged to execute a man in the middle attack. | 6.8 | 0.35% | 2025-07-11 | 2026-06-17 |
| CVE-2025-30023 | The communication protocol used between client and server had a flaw that could lead to an authenticated user performing a remote code execution attack. | 9.0 | 0.51% | 2025-07-11 | 2026-06-17 |
| CVE-2025-0358 | During an annual penetration test conducted on behalf of Axis Communication, Truesec discovered a flaw in the VAPIX Device Configuration framework that allowed a privilege escalation, enabling a lower-privileged user to gain administrator privileges. | 8.8 | 0.18% | 2025-06-02 | 2026-06-17 |
| CVE-2025-0325 | A Guard Tour VAPIX API parameter allowed the use of arbitrary values and can be incorrectly called, allowing an attacker to block access to the guard tour configuration page in the web interface of the Axis device. | 4.3 | 0.30% | 2025-06-02 | 2026-06-17 |
| CVE-2025-0324 | The VAPIX Device Configuration framework allowed a privilege escalation, enabling a lower-privileged user to gain administrator privileges. | 9.4 | 0.35% | 2025-06-02 | 2026-06-17 |
| CVE-2025-1056 | Gee-netics, member of AXIS Camera Station Pro Bug Bounty Program, has identified an issue with a specific file that the server is using. A non-admin user can modify this file to either create files or change the content of files in an admin-protected location. Axis has released a patched version for the highlighted flaw. Please refer to the Axis security advisory for more information and solution. | 6.1 | 0.20% | 2025-04-23 | 2026-06-17 |
| CVE-2025-0926 | Gee-netics, member of AXIS Camera Station Pro Bug Bounty Program, has found that it is possible for a non-admin user to remove system files causing a boot loop by redirecting a file deletion when recording video. Axis has released a patched version for the highlighted flaw. Please refer to the Axis security advisory for more information and solution. | 5.9 | 0.21% | 2025-04-23 | 2026-06-17 |
| CVE-2025-0361 | During an annual penetration test conducted on behalf of Axis Communications, Truesec discovered a flaw in the VAPIX Device Configuration framework that allowed for unauthenticated username enumeration through the VAPIX Device Configuration SSH Management API. | 4.3 | 0.35% | 2025-04-08 | 2026-06-17 |
| CVE-2024-47261 | 51l3nc3, a member of the AXIS OS Bug Bounty Program, has found that the VAPIX API uploadoverlayimage.cgi did not have sufficient input validation to allow an attacker to upload files to block access to create image overlays in the web interface of the Axis device. | 4.3 | 0.30% | 2025-04-08 | 2026-06-17 |
| CVE-2025-0360 | During an annual penetration test conducted on behalf of Axis Communication, Truesec discovered a flaw in the VAPIX Device Configuration framework that could lead to an incorrect user privilege level in the VAPIX service account D-Bus API. | 7.8 | 0.14% | 2025-03-04 | 2026-06-17 |
| CVE-2025-0359 | During an annual penetration test conducted on behalf of Axis Communication, Truesec discovered a flaw in the ACAP Application framework that allowed applications to access restricted D-Bus methods within the framework. Axis has released patched AXIS OS versions for the highlighted flaw. Please refer to the Axis security advisory for more information and solution. | 8.5 | 0.07% | 2025-03-04 | 2026-06-17 |
| CVE-2024-47262 | Dzmitry Lukyanenka, member of the AXIS OS Bug Bounty Program, has found that the VAPIX API param.cgi was vulnerable to a race condition attack allowing for an attacker to block access to the web interface of the Axis device. Other API endpoints or services not making use of param.cgi are not affected. Axis has released patched AXIS OS versions for the highlighted flaw. Please refer to the Axis security advisory for more information and solution. | 5.3 | 0.33% | 2025-03-04 | 2026-06-17 |
| CVE-2024-47260 | 51l3nc3, member of the AXIS OS Bug Bounty Program, has found that the VAPIX API mediaclip.cgi did not have a sufficient input validation allowing for uploading more audio clips then designed resulting in the Axis device running out of memory. Axis has released patched AXIS OS versions for the highlighted flaw. Please refer to the Axis security advisory for more information and solution. | 6.5 | 0.36% | 2025-03-04 | 2026-06-17 |
| CVE-2024-47259 | Girishunawane, member of the AXIS OS Bug Bounty Program, has found that the VAPIX API dynamicoverlay.cgi did not have a sufficient input validation allowing for a possible command injection leading to being able to transfer files to the Axis device with the purpose to exhaust system resources. Axis has released patched AXIS OS versions for the highlighted flaw. Please refer to the Axis security advisory for more information and solution. | 3.5 | 0.56% | 2025-03-04 | 2026-06-17 |