CVE-2026-63286: Weak Encryption
Database backups are vulnerable to offline attacks. Backups created using a version prior to the patched version are still vulnerable. AXIS Camera Station Pro automatically creates one more such backup for recovery purpose when the update is applied. Delete all these backups and change the credentials stored in AXIS Camera Station Pro.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Operational
Delete all backups created using a version prior to the patched version, including the additional recovery backup automatically created when the update is applied.
- Operational
Change the credentials stored in AXIS Camera Station Pro.
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs local access to a vulnerable database backup to perform an offline attack. No user interaction is required, but the attacker must be able to obtain the backup.
Are backups made before updating still at risk?
Yes. Backups created with a version prior to the patched version remain vulnerable even after the software is updated.
What should be done during remediation?
Delete all vulnerable backups and change the credentials stored in AXIS Camera Station Pro. The update process automatically creates an additional vulnerable recovery backup, which also needs to be deleted.