Critical · published September 10, 2025
🔥 A remote attacker can exploit neglected dependencies in AxxonSoft Axxon One VMS versions 2.0.0 to 2.0.4, leading to arbitrary code execution! Imagine running a high-security facility with outdated security cameras that can be hacked because their software hasn't been updated in years — that's exactly what happens here when third-party components are left unmaintained! This vulnerability allows attackers to run malicious code on your systems, potentially compromising sensitive data, disabling security features, and wreaking havoc on your video management system. It's like leaving the front door to your fortress wide open and inviting in intruders!
Imagine running a high-security facility with outdated security cameras that can be hacked because their software hasn't been updated in years — that's exactly what happens here when third-party components are left unmaintained! CVE-2025-10220 arises from the use of unmaintained third-party components in AxxonSoft's VMS, which could be exploited by attackers to execute arbitrary code or bypass security features, leveraging vulnerable packages like Google.Protobuf and DynamicData.
This vulnerability allows attackers to run malicious code on your systems, potentially compromising sensitive data, disabling security features, and wreaking havoc on your video management system. It's like leaving the front door to your fortress wide open and inviting in intruders! To protect your system, upgrade AxxonSoft Axxon One VMS to the latest version immediately. Regularly audit your dependencies and replace or update any unmaintained third-party components to improve your security posture. You've got this! Following these steps will significantly bolster your defenses and keep your systems secure. 🛡️
| Product | Versions | Fixed in |
|---|---|---|
| axxonsoft/axxon_one | ≥ 2.0.0, ≤ 2.0.4 | — |