CVE-2025-5718CWE-59

CVE-2025-5718

Medium · published November 11, 2025

CVSS v3.1
6.8
EPSS
0%
Percentile
30.8
In the wild
Unconfirmed
What it is

The ACAP Application framework could allow privilege escalation through a symlink attack. This vulnerability can only be exploited if the Axis device is configured to allow the installation of unsigned ACAP applications, and if an attacker convinces the victim to install a malicious ACAP application.

The record
Technical detail
CVSS v3.1
6.8 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00381 · 30.8th percentile
Weakness
CWE-59 · Improper Link Resolution Before File Access ('Link Following')
Published
2025-11-11T12:15Z
Affected products (1)
ProductVersionsFixed in
axis/axis_os≥ 12.0.0, < 12.6.3012.6.30
References (1)
https://www.axis.com/dam/public/3c/a4/6a/cve-2025-5718pdf-en-US-504214.pdf · [email protected]
EPSS history
Timeline
  • 11 NOV 06:52Z
    The ACAP Application framework could allow privilege escalation through a symlink attack
    cvelistv5