CVE-2025-12757

Executive Summary

CVE-2025-12757 is an information disclosure vulnerability in AXIS Camera Station Pro, a video management software (VMS) solution. The flaw allows a non-admin user to view information they are not permitted to, violating the principle of least privilege. With a CVSS score of 4.6 (Medium), the vulnerability requires low-privilege access but no user interaction, making it exploitable in multi-tenant or shared-access environments. The EPSS score of 0.0% indicates no active exploitation in the wild at the time of analysis, but the lack of a patch increases risk for organizations using this software.

This vulnerability is not related to a WordPress plugin or component; it is a standalone VMS application.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
• Base Score: 4.6 (Medium)
• Attack Vector (AV): Network – The vulnerability can be exploited remotely over the network.
• Attack Complexity (AC): Low – No special conditions or race conditions required.
• Privileges Required (PR): Low – An attacker needs a valid non-admin account.
• User Interaction (UI): None – No victim action required.
• Scope (S): Unchanged – The vulnerable component and the impacted component are the same.
• Confidentiality (C): Low – Limited information disclosure.
• Integrity (I): None – No data modification possible.
• Availability (A): None – No denial of service.

Threat Level: Medium. The vulnerability is easy to exploit but requires prior authentication. The primary risk is unauthorized access to sensitive configuration or surveillance data.

Deep Dive & Mechanics

The vulnerability resides in the authorization logic of AXIS Camera Station Pro. The application fails to properly enforce access controls when a non-admin user requests certain API endpoints or UI components that expose system information, camera metadata, or other privileged data.

Root Cause: The software does not validate the user's role or permissions for specific data retrieval operations. This allows a low-privileged user (e.g., operator or viewer) to enumerate cameras, view system logs, or access configuration details that should be restricted to administrators.

Attack Vector: An authenticated non-admin user sends crafted HTTP requests to the AXIS Camera Station Pro web interface or API. The server responds with data that should be filtered based on user roles.

Impact: An attacker can gather intelligence about the surveillance system, including camera IP addresses, firmware versions, network topology, and possibly recorded footage metadata. This information can be used for further attacks or privacy violations.

Vulnerable vs. Patched Code

Since no patch is available, a hypothetical fix would involve adding role-based access control (RBAC) checks before returning sensitive data.

Vulnerable Code (Conceptual):

// No role check - returns all camera data
app.get('/api/cameras', (req, res) => {
    const cameras = database.getAllCameras();
    res.json(cameras);
});

Patched Code (Conceptual):

// Role check enforced
app.get('/api/cameras', (req, res) => {
    if (req.user.role !== 'admin') {
        return res.status(403).json({ error: 'Forbidden' });
    }
    const cameras = database.getAllCameras();
    res.json(cameras);
});

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• A valid non-admin account on AXIS Camera Station Pro (e.g., operator or viewer).
• Network access to the AXIS Camera Station Pro server (typically port 80/443 or custom ports).

Exploitation Steps:

1. Log in to the AXIS Camera Station Pro web interface with the non-admin credentials.
2. Intercept traffic using a proxy like Burp Suite or OWASP ZAP.
3. Identify API endpoints that return sensitive data (e.g., /api/cameras, /api/system/info, /api/logs).
4. Send a direct request to these endpoints without modifying the session token.
5. Observe that the server returns data that should be restricted.

Example Request:

GET /api/cameras HTTP/1.1
Host: axis-camera-station.local
Cookie: session=non_admin_session_token

Expected Response:

[
    {
        "id": 1,
        "ip": "192.168.1.100",
        "model": "AXIS Q1615",
        "firmware": "9.80.1"
    },
    ...
]

Blue Team (Defensive)

Detection:

• Monitor for unusual API requests from non-admin users to sensitive endpoints.
• Look for patterns of enumeration (e.g., sequential requests to /api/cameras, /api/users, /api/config).
• Use the Sigma rule provided in the Detection Engineering section.

Mitigation:

• Apply the principle of least privilege: ensure non-admin accounts have minimal permissions.
• Implement network segmentation to limit access to the VMS server.
• Enable detailed audit logging and monitor for unauthorized access attempts.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP requests from non-admin users to endpoints like /api/cameras, /api/system/info, /api/logs, /api/config.
  • Unusual volume of API calls from a single low-privilege user.
• System IOCs:
  • Audit logs showing access to restricted resources by non-admin users.
  • Unexpected changes to user roles or permissions (if exploited further).
• File IOCs:
  • Log files containing evidence of unauthorized data retrieval (e.g., access.log entries with 200 responses to restricted endpoints).

Detection Engineering

YARA Rule

rule CVE_2025_12757_AXIS_Camera_Station_Pro_Info_Disclosure {
    meta:
        description = "Detects exploitation attempts of CVE-2025-12757 in AXIS Camera Station Pro logs"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2025-12757"
    strings:
        $api_endpoint1 = "/api/cameras"
        $api_endpoint2 = "/api/system/info"
        $api_endpoint3 = "/api/logs"
        $api_endpoint4 = "/api/config"
        $non_admin_role = "role=operator" or "role=viewer"
    condition:
        any of ($api_endpoint*) and $non_admin_role
}

Sigma Rule

title: CVE-2025-12757 - AXIS Camera Station Pro Information Disclosure
id: 8a9b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects non-admin users accessing restricted API endpoints in AXIS Camera Station Pro
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-12757
logsource:
    category: webserver
    product: axis_camera_station_pro
detection:
    selection:
        cs-uri-query|contains:
            - "/api/cameras"
            - "/api/system/info"
            - "/api/logs"
            - "/api/config"
        cs-username|contains:
            - "operator"
            - "viewer"
    condition: selection
falsepositives:
    - Legitimate admin users with similar usernames (unlikely)
level: medium

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2025-12757 - AXIS Camera Station Pro Information Disclosure Attempt";
    flow:to_server,established;
    content:"/api/cameras"; http_uri;
    content:"/api/system/info"; http_uri;
    content:"/api/logs"; http_uri;
    content:"/api/config"; http_uri;
    classtype:attempted-recon;
    sid:10000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Restrict Access: Limit network access to the AXIS Camera Station Pro server to only trusted IPs and users.
2. Review User Roles: Audit all non-admin accounts and ensure they have the minimum necessary permissions.
3. Enable Logging: Ensure detailed audit logging is enabled and monitored for suspicious activity.

Long-Term Fix:

• Apply the vendor patch once released. Monitor the Axis Communications security advisory page for updates.
• Implement a Web Application Firewall (WAF) to block unauthorized API requests.
• Consider upgrading to a patched version of AXIS Camera Station Pro.

Workarounds:

• If patching is not possible, disable or restrict access to the web interface for non-admin users.
• Use network segmentation to isolate the VMS server from general user networks.

Valters IT
DevSecOps & Cyber Threat Intelligence Division
Report generated for CVE-2025-12757