CVE-2025-0361

Published: Apr 8, 2025Modified: Jun 17, 2026

5.3

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Exploitability: 3.9 / Impact: 1.4

Source: NVD

Description

During an annual penetration test conducted on behalf of Axis Communications, Truesec discovered a flaw in the VAPIX Device Configuration framework that allowed for unauthenticated username enumeration through the VAPIX Device Configuration SSH Management API.

Affected (2)

Products: Axis: Axis Os, Axis Os 2024

2 products

Configuration A

2 vulnerable

Vulnerable Software	Affected Versions
Axis Axis Os	From 11.11.0 to 12.3.56
Axis Axis Os 2024	Before 11.11.141

Related CWEs

Observable Discrepancy

The product behaves differently or sends different responses under different circumstances in a way that is observable to an unauthorized actor, which exposes security-relevant information about the state of the product, such as whether a particular operation was successful or not.

References (1)

https://www.axis.com/dam/public/f4/9b/13/cve-2025-0361pdf-en-US-474511.pdf

Source: product-security@axis.com

Vendor Advisory

Timeline

No history available yet.