CVE-2025-10222: Sensitive Information Disclosure in Diagnostic Dumps in AxxonSoft Axxon One VMS

Q: What is the severity of CVE-2025-10222?

CVE-2025-10222 has been classified as a medium severity vulnerability due to the exposure of sensitive information.

Q: How do I fix CVE-2025-10222?

To address CVE-2025-10222, update AxxonSoft Axxon One VMS to a version later than 2.0.1.

Q: What type of information is exposed in CVE-2025-10222?

CVE-2025-10222 exposes sensitive licensing-related information, including timestamps and license states.

Q: Who is affected by CVE-2025-10222?

CVE-2025-10222 affects users of AxxonSoft Axxon One VMS versions 2.0.0 and 2.0.1 on Windows.

Q: Can a remote attacker exploit CVE-2025-10222?

No, CVE-2025-10222 can only be exploited by local attackers.

Published Sep 10, 2025

Updated

Exposure of Sensitive Information to an Unauthorized Actor (CWE-200) in the diagnostic dump component in AxxonSoft Axxon One VMS (C-Werk) 2.0.0 through 2.0.1 on Windows allows a local attacker to obtain licensing-related information such as timestamps, license states, and registry values via reading diagnostic export files created by the built-in troubleshooting tool.

Affected Software

2 affected components

AxxonSoft Axxon One VMS>=2.0.0<=2.0.1

AxxonSoft Axxon One>=2.0.0<2.0.2

Remediation

Information

Upgrade to Axxon One 2.0.2 (C-Werk) or later, where the diagnostic export tool has been refactored to exclude licensing-related sensitive variables.

Event History

Sep 10, 2025

CVE Published

via MITRE·12:34 PM

Data Sourced

via MITRE·12:34 PM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·01:15 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2025-10222?

CVE-2025-10222 has been classified as a medium severity vulnerability due to the exposure of sensitive information.

How do I fix CVE-2025-10222?