CVE-2025-5718
📋 TL;DR
This CVE describes a privilege escalation vulnerability in the ACAP Application framework through symlink attacks. It affects Axis devices configured to allow unsigned ACAP application installation. Attackers could exploit this by tricking users into installing malicious ACAP applications.
💻 Affected Systems
- Axis devices with ACAP Application framework
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise with root privileges, allowing complete control over the Axis device.
Likely Case
Limited privilege escalation within the ACAP framework context, potentially accessing sensitive device functions.
If Mitigated
No impact if unsigned ACAP applications are blocked or proper access controls are enforced.
🎯 Exploit Status
Requires social engineering to install malicious ACAP application
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Check Axis security advisory for specific patched versions
Vendor Advisory: https://www.axis.com/dam/public/3c/a4/6a/cve-2025-5718pdf-en-US-504214.pdf
Restart Required: Yes
Instructions:
1. Review Axis security advisory 2. Update affected Axis devices to patched firmware 3. Restart devices after update
🔧 Temporary Workarounds
Disable unsigned ACAP applications
allConfigure Axis devices to only allow signed ACAP applications
Configure via Axis device management interface
🧯 If You Can't Patch
- Disable ACAP application framework entirely if not needed
- Implement strict access controls and monitoring for ACAP application installation
🔍 How to Verify
Check if Vulnerable:
Check Axis device configuration for unsigned ACAP application allowanceCheck Version:
Check via Axis device web interface or management toolsVerify Fix Applied:
Verify firmware version matches patched version from Axis advisory📡 Detection & Monitoring
Log Indicators:
- Unauthorized ACAP application installation attempts
- Symlink creation in ACAP directories
Network Indicators:
- Unexpected ACAP application download traffic
SIEM Query:
Search for ACAP installation events from untrusted sources