CVE-2025-5452

MediumCVSS 6.6/10Last modified Oct 18, 2026

Description

A malicious ACAP application can gain access to admin-level service account credentials used by legitimate ACAP applications, leading to potential privilege escalation of the malicious ACAP application. This vulnerability can only be exploited if the Axis device is configured to allow the installation of unsigned ACAP applications, and if an attacker convinces the victim to install a malicious ACAP application.

Metrics

CVSS 3.1 6.6/10CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-214

Affected software

No affected versions have been published.

Timeline

Published
Nov 11, 2025
Last modified
Oct 18, 2026
NVD status
Analyzed

Related CVEs from 2025

CVE-2025-545208.6Improper Protection Against Voltage and Clock Glitches in FPGA devices, could allow an attacker with physical access to undervolt the platfoCVE-2025-545257.5Mattermost Confluence Plugin version <1.5.0 fails to handle unexpected request body which allows attackers to crash the plugin via constant CVE-2025-545267.8Fuji Electric Monitouch V-SFT-6 is vulnerable to a stack-based buffer overflow while processing a specially crafted project file, which mayCVE-2025-545276.1In JetBrains YouTrack before 2025.2.86935, 2025.2.87167, 2025.3.87341, 2025.3.87344 improper iframe configuration in widget sandbox allowCVE-2025-545288.8In JetBrains TeamCity before 2025.07 a CSRF was possible in GitHub App connection flowCVE-2025-545297.5In JetBrains TeamCity before 2025.07 a CSRF was possible in external OAuth login integrationCVE-2025-545309.8In JetBrains TeamCity before 2025.07 privilege escalation was possible due to incorrect directory permissionsCVE-2025-545319.4In JetBrains TeamCity before 2025.07 path traversal was possible via plugin unpacking on WindowsCVE-2025-545324.3In JetBrains TeamCity before 2025.07 improper access control allowed disclosure of build settings via snapshot dependenciesCVE-2025-545334.3In JetBrains TeamCity before 2025.07 improper access control allowed disclosure of build settings via VCS configurationCVE-2025-545344.8In JetBrains TeamCity before 2025.07 reflected XSS was possible on the agentpushPreset pageCVE-2025-545357.5In JetBrains TeamCity before 2025.07 password reset and email verification tokens were using weak hashing algorithms
CVE-2025-5452: Medium severity, CVSS 6.6 | Vulnix