CVE-2025-5454

Executive Summary

CVE-2025-5454 is a path traversal vulnerability in Axis ACAP (Axis Camera Application Platform) configuration files. The flaw stems from insufficient input validation, allowing an attacker to traverse directories and potentially escalate privileges. Exploitation requires the victim to install a malicious unsigned ACAP application on an Axis device configured to allow unsigned app installation. The CVSS score of 6.4 (Medium) reflects the need for user interaction and specific device configuration. No public exploit code or proof-of-concept is available, and the EPSS score is 0.0%, indicating low immediate exploitation likelihood. However, the risk increases in environments where unsigned ACAP apps are permitted.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It affects the Axis ACAP ecosystem, which is a proprietary application platform for Axis network devices. The attack vector involves social engineering to install a malicious unsigned application, making supply chain security for ACAP apps critical. Organizations should enforce strict app signing policies and only install verified ACAP applications from trusted sources.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): Required (R) – Victim must install the malicious app.
• Scope (S): Unchanged (U) – Vulnerability does not affect other components.
• Confidentiality (C): High (H) – Potential access to sensitive device files.
• Integrity (I): Low (L) – Limited ability to modify files.
• Availability (A): Low (L) – Potential denial of service via file overwrite.

Threat Level: Medium. Exploitation requires user interaction and specific device configuration, but successful attacks can lead to privilege escalation and sensitive data exposure.

Deep Dive & Mechanics

The vulnerability exists in the ACAP configuration file parsing logic. When an unsigned ACAP application is installed, the device reads a configuration file (e.g., config.xml or app.conf) without proper validation of file paths. An attacker can craft a malicious ACAP package containing a configuration file with path traversal sequences (e.g., ../../etc/passwd or ../../var/run/axis.conf). During installation, the device processes these paths, allowing the attacker to read, overwrite, or create files outside the intended application directory.

The attack flow:

1. Attacker creates a malicious ACAP package with a crafted configuration file.
2. Victim (with device configured to allow unsigned apps) installs the package.
3. The device processes the configuration file, traversing directories.
4. Attacker gains access to sensitive files (e.g., credentials, system config) or escalates privileges by overwriting critical system files.

The vulnerability is classified as CWE-22 (Improper Limitation of a Pathname to a Restricted Directory). The lack of input sanitization on file paths in the ACAP installer is the root cause.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

// ACAP installer reads config file path without validation
char config_path[256];
snprintf(config_path, sizeof(config_path), "/opt/axis/acap/%s/config.xml", app_name);
FILE *config = fopen(config_path, "r");
if (config) {
    // Process config file
    char line[1024];
    while (fgets(line, sizeof(line), config)) {
        // Directly use path from config without sanitization
        char file_path[256];
        sscanf(line, "file=%s", file_path);
        // Write to file_path without checking for ".."
        FILE *out = fopen(file_path, "w");
        // ...
    }
}

Patched Code (Conceptual):

// Patched version with path validation
char config_path[256];
snprintf(config_path, sizeof(config_path), "/opt/axis/acap/%s/config.xml", app_name);
FILE *config = fopen(config_path, "r");
if (config) {
    char line[1024];
    while (fgets(line, sizeof(line), config)) {
        char file_path[256];
        sscanf(line, "file=%s", file_path);
        // Validate path: reject if contains ".." or starts with "/"
        if (strstr(file_path, "..") != NULL || file_path[0] == '/') {
            log_error("Invalid file path: %s", file_path);
            continue;
        }
        // Ensure path is within allowed directory
        char full_path[512];
        snprintf(full_path, sizeof(full_path), "/opt/axis/acap/%s/data/%s", app_name, file_path);
        FILE *out = fopen(full_path, "w");
        // ...
    }
}

Exploitation & Lab Setup

Red Team (Attack Simulation)

Prerequisites:

• Axis device with unsigned ACAP installation enabled (default is disabled).
• Social engineering to convince victim to install the malicious app.

Steps:

1. Create a malicious ACAP package:
   • Craft a config.xml with path traversal payloads.
   • Example payload: <file>../../etc/passwd</file> to read system passwords.
2. Package the ACAP app using Axis tools (e.g., acap-sdk).
3. Host the package on a web server or deliver via email.
4. Victim installs the app via device web interface or API.
5. After installation, the device processes the config file, writing/reading files outside the app directory.

Proof-of-Concept (No public exploit available):

# Create malicious ACAP package (conceptual)
mkdir malicious_acap
cd malicious_acap
cat > config.xml << EOF
<?xml version="1.0"?>
<acap>
  <files>
    <file>../../etc/passwd</file>
  </files>
</acap>
EOF
# Package using acap-sdk (requires Axis SDK)
acap-sdk package --app-id malicious --version 1.0 --config config.xml

Blue Team (Defense & Detection)

Detection Steps:

1. Monitor ACAP installation logs for unusual file paths.
2. Enable strict app signing policies – only allow signed ACAP apps.
3. Use file integrity monitoring (FIM) on critical system files.
4. Deploy network segmentation to limit device exposure.

Hunting Queries:

• Search for ACAP installation events with path traversal patterns.
• Monitor for unexpected file writes to /etc/, /var/, or /opt/axis/.

Indicators of Compromise (IOCs)

• File Paths: /etc/passwd, /etc/shadow, /var/run/axis.conf, /opt/axis/acap/*/data/../../
• Log Entries: ACAP installation logs containing .. or absolute paths.
• Network Traffic: Outbound connections from Axis device to unknown IPs (exfiltration).
• Process Anomalies: Unexpected processes spawned by ACAP installer.
• File Hashes: Malicious ACAP package SHA256 (unknown – no public sample).

Detection Engineering

YARA Rule

rule CVE_2025_5454_ACAP_Path_Traversal {
    meta:
        description = "Detects malicious ACAP packages with path traversal in config files"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-5454"
    strings:
        $path_traversal = /\.\.\/[a-zA-Z0-9_\/]+/
        $config_xml = "config.xml"
        $acap_header = "<?xml"
    condition:
        $config_xml and $acap_header and #path_traversal > 0
}

Sigma Rule

title: ACAP Path Traversal Attempt
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects path traversal patterns in ACAP installation logs
author: Valters IT
logsource:
    product: axis
    service: acap-installer
detection:
    selection:
        EventID: 1001  # ACAP installation event
        Message|contains: 
            - '..'
            - '/etc/'
            - '/var/'
    condition: selection
falsepositives:
    - Legitimate ACAP apps using subdirectories
level: high

Suricata Rule

alert tcp any any -> any 80 (msg:"CVE-2025-5454 ACAP Path Traversal Attempt"; flow:to_server,established; content:"POST"; http_method; content:"/axis-cgi/acap/install"; http_uri; content:".."; within:100; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable unsigned ACAP installation on all Axis devices (default is disabled – verify).
2. Review device configuration: Navigate to System > ACAP > Installation and ensure "Allow unsigned applications" is unchecked.
3. Implement strict access controls to device management interfaces.

Long-Term Fixes:

• Apply vendor patch when released (monitor Axis security advisories).
• Use signed ACAP applications only from trusted sources.
• Deploy network monitoring for Axis device traffic.

Compensating Controls:

• Use file integrity monitoring (e.g., Tripwire, OSSEC) on Axis device files.
• Segment IoT devices on separate VLANs.
• Enable logging and alerting for ACAP installation events.

Valters IT – Securing your digital frontier.