CVE-2025-0361: Medium severity Axis Communications VAPIX Device Configuration vulnerability
During an annual penetration test conducted on behalf of Axis Communications, Truesec discovered a flaw in the VAPIX Device Configuration framework that allowed for unauthenticated username enumeration through the VAPIX Device Configuration SSH Management API.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-0361?
CVE-2025-0361 is classified as a medium severity vulnerability due to the potential for unauthenticated username enumeration.
How do I fix CVE-2025-0361?
To fix CVE-2025-0361, ensure you update the VAPIX Device Configuration framework to the latest version provided by Axis Communications.
What impact does CVE-2025-0361 have on my devices?
CVE-2025-0361 allows attackers to gain unauthorized information about valid usernames, which could lead to further exploitation.
Is there a workaround for CVE-2025-0361?
A potential workaround for CVE-2025-0361 includes restricting access to the SSH Management API to trusted IP addresses only.
Which products are affected by CVE-2025-0361?
CVE-2025-0361 affects the Axis Communications VAPIX Device Configuration framework.