First day on Intigriti: our agent harness found and proved a remote code execution bug in Odoo's program.

CVE-2025-30024

MediumCVSS 6.8/10Last modified Jun 17, 2026

Description

The communication protocol used between client and server had a flaw that could be leveraged to execute a man in the middle attack.

Metrics

CVSS 3.1 6.8/10CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N

Weakness enumeration

Affected software

Vendor	Product	Versions
Axis Communications AB	AXIS Device Manager	<5.32

References

https://www.axis.com/dam/public/01/d9/24/cve-2025-30024pdf-en-US-485734.pdfVendor Advisory

Timeline

Published: Jul 11, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-300257.8The communication protocol used between the server process and the service control had a flaw that could lead to a local privilege escalatio CVE-2025-300269.8The AXIS Camera Station Server had a flaw that allowed to bypass authentication that is normally required.CVE-2025-300276.7An ACAP configuration file lacked sufficient input validation, which could allow for arbitrary code execution. This vulnerability can only b CVE-2025-300288.6A vulnerability in Active Backup for Business allows unauthorized remote attackers to read arbitrary files.CVE-2025-30036.3A vulnerability, which was classified as critical, was found in ESAFENET CDG 3. Affected is an unknown function of the file /CDGServer3/User CVE-2025-300308.8A vulnerability has been identified in TeleControl Server Basic (All versions < V3.1.2.2). The affected application is vulnerable to SQL inj CVE-2025-300318.8A vulnerability has been identified in TeleControl Server Basic (All versions < V3.1.2.2). The affected application is vulnerable to SQL inj CVE-2025-300328.8A vulnerability has been identified in TeleControl Server Basic (All versions < V3.1.2.2). The affected application is vulnerable to SQL inj CVE-2025-300337.8The affected setup component is vulnerable to DLL hijacking. This could allow an attacker to execute arbitrary code when a legitimate user i CVE-2025-300345.5A vulnerability has been identified in SIMATIC RTLS Locating Manager (All versions < V3.3). Affected devices do not properly validate input CVE-2025-300359.0The vulnerability enables an attacker to fully bypass authentication in CGM CLININET and gain access to any active user account by supplying CVE-2025-300368.8Stored XSS vulnerability exists in the "Oddział" (Ward) module, in the death diagnosis description field, and allows the execution of arbitr