CVE-2025-0325

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2025-0325", "assignerOrgId": "f2daf9a0-02c2-4b83-a01d-63b3b304b807", "state": "PUBLISHED", "assignerShortName": "Axis", "dateReserved": "2025-01-08T09:38:51.961Z", "datePublished": "2025-06-02T07:36:55.800Z", "dateUpdated": "2025-06-02T13:25:19.277Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "AXIS OS", "vendor": "Axis Communications AB", "versions": [{"lessThan": "6.50.5.21", "status": "affected", "version": "6.50.0", "versionType": "semver"}, {"lessThan": "8.40.74", "status": "affected", "version": "7.0.0", "versionType": "semver"}, {"lessThan": "9.80.100", "status": "affected", "version": "9.0.0", "versionType": "semver"}, {"lessThan": "10.12.278", "status": "affected", "version": "10.0.0", "versionType": "semver"}, {"lessThan": "11.11.142", "status": "affected", "version": "11.0.0", "versionType": "semver"}, {"lessThan": "12.4.28", "status": "affected", "version": "12.0.0", "versionType": "semver"}]}], "credits": [{"lang": "en", "type": "finder", "value": "51l3nc3"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "A Guard Tour VAPIX API parameter allowed the use of arbitrary values and can be incorrectly called, allowing an attacker to block access to the guard tour configuration page in the web interface of the Axis device."}], "value": "A Guard Tour VAPIX API parameter allowed the use of arbitrary values and can be incorrectly called, allowing an attacker\u00a0to block access to the guard tour configuration page in the web interface of the Axis device."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-1287", "description": "CWE-1287: Improper Validation of Specified Type of Input", "lang": "en", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-628", "description": "CWE-628: Function Call with Incorrectly Specified Arguments", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "f2daf9a0-02c2-4b83-a01d-63b3b304b807", "shortName": "Axis", "dateUpdated": "2025-06-02T07:36:55.800Z"}, "references": [{"url": "https://www.axis.com/dam/public/d0/ae/fe/cve-2025-0325pdf-en-US-483808.pdf"}], "source": {"discovery": "UNKNOWN"}, "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-06-02T13:21:58.179166Z", "id": "CVE-2025-0325", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-06-02T13:25:19.277Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-0325", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-06-02T13:21:58.179166Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-06-02T13:22:23.523Z"}}], "cna": {"source": {"discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "finder", "value": "51l3nc3"}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Axis Communications AB", "product": "AXIS OS", "versions": [{"status": "affected", "version": "6.50.0", "lessThan": "6.50.5.21", "versionType": "semver"}, {"status": "affected", "version": "7.0.0", "lessThan": "8.40.74", "versionType": "semver"}, {"status": "affected", "version": "9.0.0", "lessThan": "9.80.100", "versionType": "semver"}, {"status": "affected", "version": "10.0.0", "lessThan": "10.12.278", "versionType": "semver"}, {"status": "affected", "version": "11.0.0", "lessThan": "11.11.142", "versionType": "semver"}, {"status": "affected", "version": "12.0.0", "lessThan": "12.4.28", "versionType": "semver"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://www.axis.com/dam/public/d0/ae/fe/cve-2025-0325pdf-en-US-483808.pdf"}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "A Guard Tour VAPIX API parameter allowed the use of arbitrary values and can be incorrectly called, allowing an attacker\u00a0to block access to the guard tour configuration page in the web interface of the Axis device.", "supportingMedia": [{"type": "text/html", "value": "A Guard Tour VAPIX API parameter allowed the use of arbitrary values and can be incorrectly called, allowing an attacker to block access to the guard tour configuration page in the web interface of the Axis device.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-1287", "description": "CWE-1287: Improper Validation of Specified Type of Input"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-628", "description": "CWE-628: Function Call with Incorrectly Specified Arguments"}]}], "providerMetadata": {"orgId": "f2daf9a0-02c2-4b83-a01d-63b3b304b807", "shortName": "Axis", "dateUpdated": "2025-06-02T07:36:55.800Z"}}}, "cveMetadata": {"cveId": "CVE-2025-0325", "state": "PUBLISHED", "dateUpdated": "2025-06-02T13:25:19.277Z", "dateReserved": "2025-01-08T09:38:51.961Z", "assignerOrgId": "f2daf9a0-02c2-4b83-a01d-63b3b304b807", "datePublished": "2025-06-02T07:36:55.800Z", "assignerShortName": "Axis"}, "dataVersion": "5.1"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "AXIS OS", "vendor": "Axis Communications AB", "versions": [{"lessThan": "6.50.5.21", "status": "affected", "version": "6.50.0", "versionType": "semver"}, {"lessThan": "8.40.74", "status": "affected", "version": "7.0.0", "versionType": "semver"}, {"lessThan": "9.80.100", "status": "affected", "version": "9.0.0", "versionType": "semver"}, {"lessThan": "10.12.278", "status": "affected", "version": "10.0.0", "versionType": "semver"}, {"lessThan": "11.11.142", "status": "affected", "version": "11.0.0", "versionType": "semver"}, {"lessThan": "12.4.28", "status": "affected", "version": "12.0.0", "versionType": "semver"}]}], "source": "product-security@axis.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A Guard Tour VAPIX API parameter allowed the use of arbitrary values and can be incorrectly called, allowing an attacker\u00a0to block access to the guard tour configuration page in the web interface of the Axis device."}, {"lang": "es", "value": "Un par\u00e1metro de Guard Tour VAPIX API permit\u00eda el uso de valores arbitrarios y se pod\u00eda llamar incorrectamente, lo que permit\u00eda a un atacante bloquear el acceso a la p\u00e1gina de configuraci\u00f3n de ronda de guardia en la interfaz web del dispositivo Axis."}], "id": "CVE-2025-0325", "lastModified": "2026-06-17T08:26:16.903", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "product-security@axis.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-0325", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-06-02T13:21:58.179166Z", "version": "2.0.3"}}]}, "published": "2025-06-02T08:15:20.767", "references": [{"source": "product-security@axis.com", "url": "https://www.axis.com/dam/public/d0/ae/fe/cve-2025-0325pdf-en-US-483808.pdf"}], "sourceIdentifier": "product-security@axis.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-628"}, {"lang": "en", "value": "CWE-1287"}], "source": "product-security@axis.com", "type": "Secondary"}]}

{}

{}