← Vulnerability feed

Vulnerability record · CVE-2025-0361 · published 8 April 2025

CVE-2025-0361: Axis os observable discrepancy vulnerability

Axis · Axis Os

During an annual penetration test conducted on behalf of Axis Communications, Truesec discovered a flaw in the VAPIX Device Configuration framework that allowed for unauthenticated username enumeration through the VAPIX Device Configuration SSH Management API.

5.3 CVSS 3.1 Medium EPSS 0.33% · top 77.0% CWE-203 · Observable discrepancy
5.3CVSS 3.1 base score
0.33%EPSS exploitation probability, 30 days
NoNot in CISA KEV
2Affected product versions listed by NVD
1References
17 Jun 2026Last modified by NVD

Description

During an annual penetration test conducted on behalf of Axis Communications, Truesec discovered a flaw in the VAPIX Device Configuration framework that allowed for unauthenticated username enumeration through the VAPIX Device Configuration SSH Management API.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Affected products

2 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://www.axis.com/dam/public/f4/9b/13/cve-2025-0361pdf-en-US-474511.pdf Vendor Advisory

Track CVE-2025-0361 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

8.8CVE-2026-1185Axis os incorrect permission assignment vulnerabilityA configuration file on the local file system had improper input validation which could allow code execution and potentially lead to privilege escala…EPSS 0.23%8.8CVE-2025-11142Axis os os command injection vulnerabilityThe VAPIX API mediaclip.cgi that did not have a sufficient input validation allowing for a possible remote code execution. This flaw can only be expl…EPSS 0.52%8.8CVE-2025-0324Axis os vulnerabilityThe VAPIX Device Configuration framework allowed a privilege escalation, enabling a lower-privileged user to gain administrator privileges.EPSS 0.40%8.8CVE-2025-0358Axis os improper privilege management vulnerabilityDuring an annual penetration test conducted on behalf of Axis Communication, Truesec discovered a flaw in the VAPIX Device Configuration framework th…EPSS 0.25%8.8CVE-2023-5800Axis os code injection vulnerabilityVintage, member of the AXIS OS Bug Bounty Program, has found that the VAPIX API create_overlay.cgi did not have a sufficient input validation allowin…EPSS 0.68%8.8CVE-2021-31988Axis os injection vulnerabilityA user controlled parameter related to SMTP test functionality is not correctly validated making it possible to add the Carriage Return and Line Feed…EPSS 0.95%8.1CVE-2023-21415Axis os path traversal vulnerabilitySandro Poppi, member of the AXIS OS Bug Bounty Program, has found that the VAPIX API overlay_del.cgi is vulnerable to path traversal attacks that all…EPSS 0.59%7.8CVE-2025-0360Axis os incorrect authorization vulnerabilityDuring an annual penetration test conducted on behalf of Axis Communication, Truesec discovered a flaw in the VAPIX Device Configuration framework th…EPSS 0.15%

Source: NIST National Vulnerability Database (record CVE-2025-0361), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.