CVE-2025-3892

MediumCVSS 6.7/10Last modified Jun 17, 2026

Description

ACAP applications can be executed with elevated privileges, potentially leading to privilege escalation. This vulnerability can only be exploited if the Axis device is configured to allow the installation of unsigned ACAP applications, and if an attacker convinces the victim to install a malicious ACAP application.

Metrics

CVSS 3.1 6.7/10CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-250

Affected software

Vendor	Product	Versions
Axis Communications AB	AXIS OS	>= 12.0.0, < 12.5.31

References

https://www.axis.com/dam/public/ae/19/16/cve-2025-3892pdf-en-US-492760.pdfVendor Advisory

Timeline

Published: Aug 12, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-38938.6While editing pages managed by MegaBIP a user with high privileges is prompted to give a reasoning for performing this action. Input provide CVE-2025-38944.8Text editor embedded into MegaBIP software does not neutralize user input allowing Stored XSS attacks on other users. In order to use the ed CVE-2025-38959.1Token used for resetting passwords in MegaBIP software are generated using a small space of random values combined with a queryable value. CVE-2025-38975.9The EUCookieLaw plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 2.7.2 via the 'file_get_cont CVE-2025-38986.5CWE-20: Improper Input Validation vulnerability exists that could cause Denial of Service when an authenticated malicious user sends HTTPS r CVE-2025-38995.4CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability exists in Certificates page on We CVE-2025-39006.1Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Colorbox allows Cross-Site Scri CVE-2025-39016.1Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Bootstrap Site Alert allows Cro CVE-2025-39026.1Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Block Class allows Cross-Site S CVE-2025-39037.3Vulnerability in Drupal UEditor - 百度编辑器.This issue affects UEditor - 百度编辑器: *.*.CVE-2025-39047.3Vulnerability in Drupal Sportsleague.This issue affects Sportsleague: *.*.CVE-2025-39055.4CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability exists impacting PLC system varia