CVE-2025-0359
📋 TL;DR
This vulnerability in Axis Communication's ACAP Application framework allows applications to bypass D-Bus method restrictions, potentially enabling unauthorized access to sensitive system functions. It affects Axis devices running vulnerable AXIS OS versions. The flaw was discovered during a penetration test by Truesec.
💻 Affected Systems
- Axis devices with ACAP Application framework
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
An attacker could gain full control of affected Axis devices, execute arbitrary code, access sensitive data, or disrupt device operations.
Likely Case
Unauthorized applications could access restricted system functions, potentially leading to privilege escalation, data leakage, or service disruption.
If Mitigated
With proper network segmentation and access controls, impact would be limited to isolated network segments.
🎯 Exploit Status
Requires ability to deploy or manipulate ACAP applications
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Refer to Axis security advisory for specific patched versions
Vendor Advisory: https://www.axis.com/dam/public/68/08/c5/cve-2025-0359pdf-en-US-466885.pdf
Restart Required: Yes
Instructions:
1. Review Axis security advisory. 2. Identify affected devices. 3. Download and apply patched AXIS OS version. 4. Restart devices. 5. Verify patch application.
🔧 Temporary Workarounds
Network Segmentation
allIsolate Axis devices from untrusted networks and restrict access to necessary services only
ACAP Application Restriction
allDisable or restrict installation of untrusted ACAP applications
🧯 If You Can't Patch
- Implement strict network access controls to limit device exposure
- Disable ACAP framework if not required for operations
🔍 How to Verify
Check if Vulnerable:
Check AXIS OS version against vulnerable versions listed in Axis advisoryCheck Version:
Check device web interface or use Axis device management toolsVerify Fix Applied:
Verify AXIS OS version matches patched version from advisory and test D-Bus method restrictions📡 Detection & Monitoring
Log Indicators:
- Unauthorized D-Bus method calls
- Unexpected ACAP application activity
- Privilege escalation attempts
Network Indicators:
- Unusual network traffic to/from Axis devices
- Unexpected D-Bus communication patterns
SIEM Query:
Search for D-Bus method access logs from Axis devices outside normal patterns