CVE-2025-10220

Executive Summary

CVE-2025-10220 is a critical vulnerability (CVSS 9.8) affecting AxxonSoft Axxon One VMS versions 2.0.0 through 2.0.4 on Windows. The root cause is the use of unmaintained third-party NuGet components (CWE-1104), including Google.Protobuf, DynamicData, and System.Runtime.CompilerServices.Unsafe. These outdated dependencies contain known security flaws that allow a remote, unauthenticated attacker to execute arbitrary code or bypass security features. The vulnerability is network-exploitable with low complexity and requires no user interaction, making it a prime target for ransomware groups and APTs targeting video surveillance infrastructure.

Supply Chain & Package Security

The vulnerability stems from the inclusion of unmaintained NuGet packages. Specifically, the use of outdated versions of Google.Protobuf, DynamicData, and System.Runtime.CompilerServices.Unsafe introduces known CVEs. This is a classic software supply chain risk where the vendor failed to update dependencies, leaving the application exposed to publicly known exploits. The lack of a vendor patch at the time of analysis means any deployment of Axxon One VMS 2.0.0-2.0.4 is at immediate risk.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – Exploit stays within the vulnerable component.
• Confidentiality (C): High (H) – Full data access possible.
• Integrity (I): High (H) – Full system control possible.
• Availability (A): High (H) – Denial of service or full compromise.

Threat Level: Critical. The combination of remote exploitation, no authentication, and high impact makes this a top-priority vulnerability for any organization using Axxon One VMS.

Deep Dive & Mechanics

The vulnerability is not a single code flaw but a systemic issue of using outdated third-party libraries. The NuGet packages in question have known vulnerabilities:

• Google.Protobuf: Older versions are susceptible to denial-of-service or remote code execution via malformed protobuf messages.
• DynamicData: Unmaintained versions may contain memory corruption or deserialization flaws.
• System.Runtime.CompilerServices.Unsafe: Outdated versions can lead to type confusion or memory safety issues.

An attacker can craft a malicious network packet or file that, when processed by the Axxon One VMS server, triggers a vulnerability in one of these libraries. Since the libraries are used for core functionality (e.g., serialization, data binding), the attack surface is broad. The exact exploitation path depends on which library is targeted, but the common vector is sending a specially crafted request to the VMS service.

Vulnerable vs. Patched Code

Since no official patch is available, the "patched" state would involve updating the NuGet packages to their latest secure versions.

Vulnerable (NuGet package reference):

<PackageReference Include="Google.Protobuf" Version="3.21.0" />
<PackageReference Include="DynamicData" Version="7.0.0" />
<PackageReference Include="System.Runtime.CompilerServices.Unsafe" Version="5.0.0" />

Patched (NuGet package reference):

<PackageReference Include="Google.Protobuf" Version="3.25.0" />
<PackageReference Include="DynamicData" Version="8.0.0" />
<PackageReference Include="System.Runtime.CompilerServices.Unsafe" Version="6.0.0" />

The patched versions contain security fixes for the known CVEs. The code logic itself may not change, but the underlying library behavior is corrected.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Axxon One VMS 2.0.0-2.0.4 running on Windows.
• Network access to the VMS service (default port 8080 or 443).
• Knowledge of the target library's vulnerability (e.g., CVE-2023-XXXX for Google.Protobuf).

Exploitation Steps:

1. Reconnaissance: Scan for Axxon One VMS instances using Shodan dorks: "Axxon One" or "AxxonSoft VMS".
2. Identify Vulnerable Library: Use a tool like nuget-package-analyzer to check the version of Google.Protobuf in the target.
3. Craft Payload: For example, if targeting Google.Protobuf, create a malformed protobuf message that triggers a buffer overflow.
4. Send Payload: Use a script to send the payload to the VMS service.

Example Python script (conceptual):

import socket

payload = b'\x00\x01\x02'  # Malformed protobuf data
sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
sock.connect(('target_ip', 8080))
sock.send(payload)
sock.close()

Note: No public exploit code is available, so this is a theoretical approach.

Blue Team

Detection:

• Monitor for unusual network traffic to the VMS service, especially malformed protobuf messages.
• Use the Sigma and Suricata rules provided below.
• Check for unexpected child processes spawned by the Axxon One service.

Hunting:

• Search for logs indicating crashes or exceptions in Google.Protobuf or DynamicData.
• Look for outbound connections from the VMS server to unknown IPs (potential C2).

Mitigation:

• Isolate the VMS server on a separate VLAN.
• Apply strict firewall rules to limit access to the VMS service.
• If possible, use a WAF to inspect and block malformed protobuf traffic.

Indicators of Compromise (IOCs)

• Network:
  • Malformed protobuf messages (unusual byte sequences) on port 8080/443.
  • Outbound connections to known malicious IPs from the VMS server.
• File:
  • Unexpected DLLs in the Axxon One installation directory (e.g., malicious.dll).
  • Modified AxxonOne.exe or AxxonOneService.exe.
• Process:
  • AxxonOneService.exe spawning cmd.exe or powershell.exe.
  • High CPU usage from Google.Protobuf.dll or DynamicData.dll.
• Registry:
  • Unauthorized changes to HKLM\SOFTWARE\AxxonSoft\Axxon One.

Detection Engineering

YARA Rule

rule CVE_2025_10220_Axxon_One_VMS {
    meta:
        description = "Detects vulnerable Axxon One VMS installations with outdated NuGet packages"
        author = "Valters IT"
        date = "2025-04-10"
        hash = "d41d8cd98f00b204e9800998ecf8427e"
    strings:
        $protobuf = "Google.Protobuf" nocase
        $dynamicdata = "DynamicData" nocase
        $unsafe = "System.Runtime.CompilerServices.Unsafe" nocase
        $version_low = "5.0.0" nocase
        $version_med = "7.0.0" nocase
    condition:
        ( $protobuf or $dynamicdata or $unsafe ) and ( $version_low or $version_med )
}

Sigma Rule

title: CVE-2025-10220 - Axxon One VMS Exploitation Attempt
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects network traffic targeting Axxon One VMS with malformed protobuf data
author: Valters IT
date: 2025/04/10
logsource:
    category: network_connection
    product: windows
detection:
    selection:
        DestinationPort: 8080
        Payload|contains: '\x00\x01\x02'  # Example malformed pattern
    condition: selection
falsepositives:
    - Legitimate protobuf traffic with similar patterns (rare)
level: critical

Suricata Rule

alert tcp any any -> any 8080 (msg:"CVE-2025-10220 - Axxon One VMS Malformed Protobuf"; content:"|00 01 02|"; depth:3; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Isolate all Axxon One VMS 2.0.0-2.0.4 instances from the internet and untrusted networks.
2. Apply strict firewall rules to allow only trusted IPs to access the VMS service.
3. Monitor for any signs of compromise using the IOCs and detection rules above.

Long-term Fix:

• Update the NuGet packages to their latest secure versions (see Vulnerable vs. Patched Code section).
• Contact AxxonSoft for an official patch or upgrade to a newer version of Axxon One.
• Implement a software composition analysis (SCA) tool to automatically detect outdated dependencies in the future.

Workaround:

• If patching is not possible, disable the vulnerable features that use the outdated libraries (e.g., disable protobuf-based communication if feasible).

Valters IT