CVE-2025-0926

Executive Summary

CVE-2025-0926 is a local privilege escalation vulnerability in Axis Camera Station Pro (ACSP) that allows a non-admin user to remove system files by redirecting a file deletion operation during video recording. This can cause a boot loop, leading to a denial of service (DoS) condition. The vulnerability was discovered by Gee-netics as part of the AXIS Camera Station Pro Bug Bounty Program. The CVSS score is 5.9 (Medium), and while no public exploit code exists, the attack vector is local and requires low privileges. Axis has released a patched version; users are strongly advised to apply the update immediately.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It affects a proprietary video management system (Axis Camera Station Pro) and is not part of an open-source supply chain.

CVSS Breakdown & Threat Level

• CVSS Score: 5.9 (Medium)
• Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
• Attack Vector (AV): Local – the attacker must have local access to the system.
• Attack Complexity (AC): Low – no special conditions are required.
• Privileges Required (PR): Low – a non-admin user account is sufficient.
• User Interaction (UI): None – no user action is needed beyond the attacker’s own actions.
• Scope (S): Unchanged – the vulnerable component and the impacted component are the same.
• Confidentiality (C): None – no data is exposed.
• Integrity (I): High – system files can be deleted, compromising system integrity.
• Availability (A): High – the boot loop causes a denial of service.

Threat Level: Medium. The attack requires local access, but the impact on availability and integrity is severe. In a physical security environment, a boot loop can disable surveillance capabilities.

Deep Dive & Mechanics

The vulnerability lies in the way Axis Camera Station Pro handles file deletion during video recording. When a non-admin user triggers a recording event that involves file deletion (e.g., deleting old recordings to free space), the application does not properly validate the file path. An attacker can exploit a symlink or path traversal to redirect the deletion to critical system files (e.g., boot configuration, kernel modules, or system libraries). This causes the system to enter a boot loop upon restart, rendering the server inoperable.

Root Cause: Improper validation of file paths in the deletion routine (CWE-59: Improper Link Resolution Before File Access). The application follows symbolic links without checking if the target is within an allowed directory.

Attack Flow:

1. Attacker gains low-privileged access to the ACSP server (e.g., via a compromised user account or physical access).
2. Attacker creates a symbolic link from a legitimate recording file to a critical system file (e.g., /etc/fstab or /boot/grub/grub.cfg).
3. Attacker triggers a recording deletion event (e.g., by filling up disk space or using a scheduled cleanup).
4. The ACSP software deletes the file pointed to by the symlink, removing the critical system file.
5. On next reboot, the system fails to boot (boot loop).

Vulnerable vs. Patched Code

No specific code snippets are available from public sources. The following is a conceptual representation.

Vulnerable Code (Conceptual):

void delete_recording(char *user_path) {
    // No validation of user_path
    if (unlink(user_path) != 0) {
        // error handling
    }
}

Patched Code (Conceptual):

void delete_recording(char *user_path) {
    // Resolve symlinks and check if path is within allowed directory
    char real_path[PATH_MAX];
    if (realpath(user_path, real_path) == NULL) {
        // error: invalid path
        return;
    }
    if (strncmp(real_path, ALLOWED_RECORDING_DIR, strlen(ALLOWED_RECORDING_DIR)) != 0) {
        // error: path outside allowed directory
        return;
    }
    if (unlink(real_path) != 0) {
        // error handling
    }
}

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Local access to an Axis Camera Station Pro server (version prior to patch).
• A non-admin user account (e.g., operator or viewer role).

Steps:

1. Identify the recording directory (e.g., /var/spool/acsp/recordings/).
2. Create a symbolic link:

   ln -s /etc/fstab /var/spool/acsp/recordings/exploit.mkv
   

3. Trigger a recording deletion (e.g., by filling the disk or using a scheduled task).
4. The system will delete /etc/fstab.
5. Reboot the server (or wait for a reboot) to cause a boot loop.

Note: No public exploit code is available. This is a conceptual demonstration.

Blue Team (Detection & Prevention)

Detection:

• Monitor for creation of symbolic links in recording directories.
• Alert on deletion of critical system files (e.g., /etc/fstab, /boot/*).
• Use file integrity monitoring (FIM) on system directories.

Prevention:

• Apply the vendor patch immediately.
• Restrict non-admin users from writing to recording directories.
• Use mandatory access controls (e.g., SELinux, AppArmor) to prevent symlink attacks.
• Enable logging of file deletion events.

Indicators of Compromise (IOCs)

• File System Changes:
  • Unexpected symbolic links in recording directories (e.g., /var/spool/acsp/recordings/*.lnk).
  • Deletion of critical system files (e.g., /etc/fstab, /boot/grub/grub.cfg, /etc/passwd).
• System Behavior:
  • Boot loop after a recording deletion event.
  • System logs showing unlink() calls on system paths from the ACSP process.
• Log Entries:
  • audit.log entries: type=SYSCALL syscall=unlink ...
  • ACSP logs: Deleted file: /etc/fstab (unexpected path).

Detection Engineering

YARA Rule

rule CVE_2025_0926_Symlink_Deletion {
    meta:
        description = "Detects symbolic links pointing to critical system files in Axis Camera Station Pro recording directories"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-0926"
    strings:
        $symlink_target = /ln -s \/(etc|boot|lib|bin|sbin)\//
    condition:
        $symlink_target
}

Sigma Rule

title: CVE-2025-0926 - Symlink Deletion in Axis Camera Station Pro
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects deletion of critical system files by Axis Camera Station Pro process
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-0926
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith: '\acsp.exe'
        CommandLine|contains: 'unlink'
    filter:
        CommandLine|contains: '\var\spool\acsp\recordings\'
    condition: selection and not filter
falsepositives:
    - Legitimate deletion of recording files
level: high

Suricata Rule

alert tcp any any -> any any (msg:"CVE-2025-0926 - Potential Symlink Deletion in Axis Camera Station Pro"; flow:to_server; content:"unlink"; nocase; content:"/etc/"; distance:0; within:100; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Apply Patch: Update Axis Camera Station Pro to the latest version as per the vendor advisory.
2. Restrict User Permissions: Remove write access to recording directories for non-admin users.
3. Enable Auditing: Monitor file deletion events and symlink creation.

Long-Term Measures:

• Implement file integrity monitoring (FIM) on system directories.
• Use application whitelisting to prevent unauthorized processes.
• Conduct regular security audits of video management systems.

Workaround (if patch cannot be applied):

• Disable automatic deletion of recordings and manually manage disk space.
• Use a separate partition for recordings with noexec and nosuid options.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert