CVE-2025-5454: Input Validation
Published Nov 11, 2025
·Updated
An ACAP configuration file lacked sufficient input validation, which could allow a path traversal attack leading to potential privilege escalation. This vulnerability can only be exploited if the Axis device is configured to allow the installation of unsigned ACAP applications, and if an attacker convinces the victim to install a malicious ACAP application.
Affected Software
234 affected components
Axis Axis Device
All of the following
Axis AXIS OS>=12.0.0<12.6.18
Any of the following
Axis A1210 \(-b\)
Axis A1214
Axis A1601
Axis A1610 \(-b\)
Axis A1710-b
Axis A1810-b
Axis A8207-ve Mk Ii
Axis C1110-e
Axis C1111-e
Axis C1210-e
Axis C1211-e
Axis C1310-e Mk Ii
Axis C1410 Mk Ii
Axis C1510
Axis C1511
Axis C1610-ve
Axis C1710
Axis C1720
Axis C6110
Axis C8110
Axis C8210
Axis D1110
Axis D201-s Xpt Q6075
Axis D2110-ve
Axis D2210-ve
Axis D3110 Mk Ii
Axis D4100-ve Mk Ii
Axis D4200-ve
Axis D6310
Axis Excam Xf Q1785
Axis Excam Xpt Q6075
Axis F9104-b Main Unit
Axis F9104-b Mk Ii Main Unit
Axis F9111-r Mk Ii Main Unit
Axis F9111 Main Unit
Axis F9111 Mk Ii Main Unit
Axis F9114-b-r Mk Ii Main Unit
Axis F9114-b Main Unit
Axis F9114-bt
Axis F9114 Main Unit
Axis Fa51
Axis Fa51-b
Axis Fa54
Axis I7010-safety
Axis I7010-ve
Axis I7020
Axis I8016-lve
Axis I8116-e
Axis I8307-ve
Axis M1055-l
Axis M1075-l
Axis M1135
Axis M1135-e Mk Ii
Axis M1137
Axis M1137-e Mk Ii
Axis M2035-le
Axis M2036-le
Axis M3057-plr Mk Ii
Axis M3085-v
Axis M3086-v
Axis M3086-v Mic
Axis M3088-v
Axis M3125-lve
Axis M3126-lve
Axis M3128-lve
Axis M3215-lve
Axis M3216-lve
Axis M3905-r
Axis M4215-lv
Axis M4215-v
Axis M4216-lv
Axis M4216-v
Axis M4218-lv
Axis M4218-v
Axis M4225-lve
Axis M4227-lve
Axis M4228-lve
Axis M4308-ple
Axis M4317-plr
Axis M4317-plve
Axis M4318-plr
Axis M4318-plve
Axis M4327-p
Axis M4328-p
Axis M5000
Axis M5000-g
Axis M5074
Axis M5075
Axis M5075-g
Axis M5526-e
Axis M7104
Axis M7116
Axis P1245 Mk Ii
Axis P1265 Mk Ii
Axis P1275 Mk Ii
Axis P1385
Axis P1385-b
Axis P1385-be
Axis P1385-e
Axis P1387
Axis P1387-b
Axis P1387-be
Axis P1387-le
Axis P1388
Axis P1388-b
Axis P1388-be
Axis P1388-le
Axis P1465-le
Axis P1465-le-3
Axis P1467-le
Axis P1468-le
Axis P1468-xle
Axis P1475-le
Axis P1518-e
Axis P1518-le
Axis P3265-lv
Axis P3265-lve
Axis P3265-lve-3
Axis P3265-v
Axis P3267-lv
Axis P3267-lve
Axis P3267-lve Mic
Axis P3268-lv
Axis P3268-lve
Axis P3268-slve
Axis P3275-lv
Axis P3275-lve
Axis P3277-lv
Axis P3277-lve
Axis P3278-lv
Axis P3278-lve
Axis P3285-lv
Axis P3285-lve
Axis P3287-lv
Axis P3287-lve
Axis P3288-lv
Axis P3288-lve
Axis P3735-ple
Axis P3737-ple
Axis P3738-ple
Axis P3747-plve
Axis P3748-plve
Axis P3818-pve
Axis P3827-pve
Axis P3905-r Mk Iii
Axis P3925-lre
Axis P3925-r
Axis P3935-lr
Axis P4705-plve
Axis P4707-plve
Axis P4708-plve
Axis P5654-e
Axis P5654-e Mk Ii
Axis P5655-e
Axis P5676-le
Axis P7304
Axis P7316
Axis P9117-pv
Axis Q1615-le Mk Iii
Axis Q1615 Mk Iii
Axis Q1656
Axis Q1656-b
Axis Q1656-be
Axis Q1656-ble
Axis Q1656-dle
Axis Q1656-le
Axis Q1686-dle
Axis Q1715
Axis Q1728
Axis Q1728-le
Axis Q1798-le
Axis Q1800-le
Axis Q1800-le-3
Axis Q1805-le
Axis Q1806-le
Axis Q1808-le
Axis Q1809-le
Axis Q1961-te
Axis Q1961-xte
Axis Q1971-e
Axis Q1972-e
Axis Q2101-te
Axis Q2111-e
Axis Q2112-e
Axis Q3536-lve
Axis Q3538-lve
Axis Q3538-slve
Axis Q3546-lve
Axis Q3548-lve
Axis Q3556-lve
Axis Q3558-lve
Axis Q3626-ve
Axis Q3628-ve
Axis Q3819-pve
Axis Q3839-pve
Axis Q3839-spve
Axis Q4809-pve
Axis Q6020-e
Axis Q6074
Axis Q6074-e
Axis Q6075
Axis Q6075-e
Axis Q6075-s
Axis Q6075-se
Axis Q6078-e
Axis Q6135-le
Axis Q6225-le
Axis Q6300-e
Axis Q6315-le
Axis Q6318-le
Axis Q6355-le
Axis Q6358-le
Axis Q8615-e
Axis Q8752-e
Axis Q8752-e Mk Ii
Axis Q9307-lv
Axis S3008
Axis S3008 Mk Ii
Axis S3016
Axis S4000
Axis V5925
Axis V5938
Axis W100
Axis W101
Axis W102
Axis W110
Axis W120
Axis W401
Axis Xc1311
Axis Xf40-q1785
Axis Xfq1656
Axis Xpq1785
Event History
Nov 11, 2025
CVE Published
via MITRE·06:50 AM
Data Sourced
via MITRE·06:50 AM
DescriptionSeverityWeakness
Data Sourced
via NVD·07:15 AM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2025-5454?
CVE-2025-5454 has been assessed as a high severity vulnerability due to its potential for privilege escalation.
2
How do I fix CVE-2025-5454?
To mitigate CVE-2025-5454, ensure that the Axis device is configured to disallow the installation of unsigned ACAP applications.
3
What types of attacks can CVE-2025-5454 facilitate?
CVE-2025-5454 can facilitate path traversal attacks leading to privilege escalation.
4
On which devices does CVE-2025-5454 affect?
CVE-2025-5454 affects Axis devices that allow the installation of unsigned ACAP applications.
5
What conditions are necessary for exploiting CVE-2025-5454?
Exploitation of CVE-2025-5454 requires that the Axis device is configured to permit unsigned ACAP application installations.