CVE-2025-5718

Executive Summary

CVE-2025-5718 is a privilege escalation vulnerability in the Axis ACAP (Axis Camera Application Platform) Application framework. The flaw allows a local attacker to perform a symlink attack, potentially gaining elevated privileges on the Axis device. The attack requires the device to be configured to allow installation of unsigned ACAP applications, and the victim must be tricked into installing a malicious ACAP application. The CVSS score is 6.8 (Medium), but the actual risk is elevated due to the potential for full device compromise. No public exploit code or proof-of-concept is currently available, and no official patch has been released by Axis.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It is a firmware-level issue within the Axis ACAP framework, which is a proprietary application platform for Axis network cameras and edge devices. The attack vector relies on social engineering to install a malicious unsigned ACAP application, making it a supply chain risk for Axis device administrators who may inadvertently install untrusted applications.

CVSS Breakdown & Threat Level

• CVSS Score: 6.8 (Medium)
• Attack Vector (AV): Local (AV:L) – The attacker must have local access to the device or be able to install an application.
• Attack Complexity (AC): Low (AC:L) – The symlink attack is straightforward once the malicious application is installed.
• Privileges Required (PR): None (PR:N) – The attacker does not need prior privileges.
• User Interaction (UI): Required (UI:R) – The victim must install the malicious ACAP application.
• Scope (S): Unchanged (S:U) – The vulnerability does not cross a trust boundary.
• Confidentiality (C): High (C:H) – Full device data access possible.
• Integrity (I): High (I:H) – Full device control possible.
• Availability (A): High (A:H) – Device could be rendered inoperable.

Threat Level: High for devices configured to allow unsigned ACAP installations. The requirement for user interaction reduces the immediate risk, but the potential for full device compromise makes this a critical issue for Axis device administrators.

Deep Dive & Mechanics

The Axis ACAP framework allows third-party applications to run on Axis network cameras and edge devices. The vulnerability lies in how the framework handles file system operations during application installation or execution. A symlink attack (CWE-59) occurs when an application creates a symbolic link pointing to a file or directory that the application should not normally access. If the ACAP framework does not properly validate the target of symbolic links, a malicious ACAP application can create a symlink that points to a sensitive system file (e.g., /etc/passwd, /var/run/, or device configuration files). When the framework or another process accesses the symlink, it inadvertently reads or writes to the target file, leading to privilege escalation.

Attack Flow:

1. The attacker crafts a malicious ACAP application that, upon installation or execution, creates a symbolic link from a location writable by the application to a sensitive system file.
2. The victim, with administrative privileges on the device, installs the unsigned ACAP application (device must be configured to allow unsigned apps).
3. The malicious application triggers the symlink attack, causing the ACAP framework to access the linked file with elevated privileges.
4. The attacker gains read/write access to sensitive files, potentially leading to full device compromise (e.g., modifying device configuration, extracting credentials, or executing arbitrary code as root).

Vulnerable vs. Patched Code

Since no official patch is available, the following is a hypothetical comparison based on the vulnerability description.

Vulnerable Code (Conceptual):

// ACAP framework - file access without symlink validation
int read_config_file(const char *path) {
    FILE *file = fopen(path, "r");
    if (file == NULL) {
        return -1;
    }
    // Read and process file contents
    fclose(file);
    return 0;
}

Patched Code (Conceptual):

// ACAP framework - file access with symlink validation
#include <unistd.h>
#include <sys/stat.h>

int read_config_file(const char *path) {
    struct stat st;
    // Check if the path is a symlink
    if (lstat(path, &st) == 0 && S_ISLNK(st.st_mode)) {
        // Reject symlinks or resolve safely
        return -1; // Or use realpath() to resolve and validate
    }
    FILE *file = fopen(path, "r");
    if (file == NULL) {
        return -1;
    }
    // Read and process file contents
    fclose(file);
    return 0;
}

Exploitation & Lab Setup

Red Team (Attacker)

Prerequisites:

• Axis device with ACAP support and unsigned application installation enabled.
• Ability to craft a malicious ACAP application (.eap file).
• Social engineering to convince the victim to install the application.

Lab Setup:

1. Set up an Axis device (e.g., Axis Q-series camera) with default settings.
2. Enable unsigned ACAP installation via the web interface: Settings > System > ACAP > Allow unsigned applications.
3. Create a malicious ACAP application that performs a symlink attack.

Example Malicious ACAP Application (Conceptual):

// malicious_acap.c
#include <stdio.h>
#include <unistd.h>
#include <sys/stat.h>

int main() {
    // Create a symlink from a writable location to /etc/shadow
    symlink("/etc/shadow", "/tmp/malicious_link");
    // Trigger the ACAP framework to read the symlink
    // (e.g., by writing to a log file that the framework reads)
    FILE *log = fopen("/tmp/malicious_link", "r");
    if (log) {
        char buffer[256];
        while (fgets(buffer, sizeof(buffer), log)) {
            printf("%s", buffer);
        }
        fclose(log);
    }
    return 0;
}

Compile and Package:

# Cross-compile for Axis ARM architecture
arm-linux-gnueabihf-gcc -o malicious_acap malicious_acap.c
# Package into .eap file (Axis ACAP format)
# This typically involves creating a manifest and tar archive

Delivery:

• Host the .eap file on a website or send via email.
• Convince the victim to install it via the Axis device web interface.

Blue Team (Defender)

Detection:

• Monitor for installation of unsigned ACAP applications.
• Check for unexpected symlinks in writable directories (e.g., /tmp, /var/tmp).
• Use file integrity monitoring to detect changes to sensitive system files.

Prevention:

• Disable unsigned ACAP application installation on all Axis devices.
• Implement application whitelisting for ACAP applications.
• Use network segmentation to limit access to Axis devices.

Hunting:

• Search for symlinks pointing to sensitive files:

  find / -type l -exec ls -la {} \; 2>/dev/null | grep -E "(/etc|/var|/root)"
  

• Review ACAP application logs for unusual file access patterns.

Indicators of Compromise (IOCs)

• File System:
  • Unexpected symbolic links in /tmp/, /var/tmp/, or application directories pointing to /etc/shadow, /etc/passwd, /var/run/, or device configuration files.
  • Modified system files (e.g., /etc/shadow, /etc/passwd).
• Processes:
  • Unusual ACAP application processes running with elevated privileges.
  • Processes accessing sensitive files via symlinks.
• Network:
  • Outbound connections from the Axis device to unknown IPs (potential C2).
  • Unusual DNS queries from the device.
• Logs:
  • ACAP application installation logs showing unsigned application installation.
  • System logs showing symlink creation or file access errors.

Detection Engineering

YARA Rule

rule CVE_2025_5718_Symlink_Attack {
    meta:
        description = "Detects malicious ACAP applications attempting symlink attacks"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-5718"
    strings:
        $symlink_call = "symlink(" ascii wide nocase
        $sensitive_path = "/etc/shadow" ascii wide nocase
        $sensitive_path2 = "/etc/passwd" ascii wide nocase
        $sensitive_path3 = "/var/run" ascii wide nocase
    condition:
        any of ($symlink_call) and any of ($sensitive_path*)
}

Sigma Rule

title: CVE-2025-5718 - Symlink Attack via Malicious ACAP Application
id: 8a4b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects creation of symbolic links to sensitive files on Axis devices
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-5718
logsource:
    product: linux
    service: auditd
detection:
    selection:
        type: 'SYSCALL'
        syscall: 'symlink'
        target:
            - '/etc/shadow'
            - '/etc/passwd'
            - '/var/run/*'
    condition: selection
falsepositives:
    - Legitimate ACAP applications that use symlinks for configuration
level: high

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-5718 - Potential ACAP Symlink Attack - Outbound C2"; flow:to_server,established; content:"|2f 65 74 63 2f 73 68 61 64 6f 77|"; fast_pattern; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable unsigned ACAP application installation on all Axis devices. This is the primary mitigation.
2. Review installed ACAP applications and remove any that are not from trusted sources.
3. Monitor device logs for signs of exploitation.

Long-term Fixes:

• Apply firmware updates from Axis when a patch becomes available.
• Implement application whitelisting for ACAP applications.
• Use network segmentation to isolate Axis devices from untrusted networks.

Workarounds:

• If unsigned ACAP installation is required for business reasons, implement strict change management and only install applications from verified sources.
• Use file integrity monitoring (FIM) to detect unauthorized changes to sensitive files.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert