CVE-2025-6298

Executive Summary

CVE-2025-6298 is a privilege escalation vulnerability affecting Axis ACAP (Axis Camera Application Platform) applications. The flaw stems from improper input validation, allowing a malicious ACAP application to gain elevated privileges on the Axis device. Exploitation requires the device to be configured to allow installation of unsigned ACAP applications and social engineering to convince a victim to install the malicious app. With a CVSS score of 6.7 (Medium), the risk is elevated due to the potential for full device compromise if exploited. No public exploit code or patch is currently available.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby ecosystems. It is specific to the Axis ACAP platform, which is a proprietary application framework for Axis network cameras and edge devices. The risk is primarily in the supply chain of ACAP applications—unsigned apps can be distributed through unofficial channels, and users may be tricked into installing them.

CVSS Breakdown & Threat Level

• CVSS Score: 6.7 (Medium)
• Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
• Attack Vector: Local (requires physical or logical access to the device)
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: Required (victim must install the malicious ACAP)
• Scope: Unchanged
• Confidentiality Impact: High
• Integrity Impact: High
• Availability Impact: High

Threat Level: Medium. Exploitation is not trivial due to the prerequisite of unsigned app installation and user interaction, but once achieved, the attacker gains full control over the device.

Deep Dive & Mechanics

The vulnerability exists in the ACAP runtime environment, which does not properly validate input parameters when loading or executing ACAP applications. An unsigned ACAP application can craft malicious input that bypasses security checks, allowing it to escalate privileges from the standard ACAP sandbox to root-level access.

Root Cause: Improper input validation in the ACAP application loader. The loader fails to sanitize parameters passed to system calls or privileged functions, enabling an attacker to inject commands or manipulate memory.

Attack Flow:

1. Attacker creates a malicious unsigned ACAP application.
2. Attacker convinces victim (e.g., via phishing or physical access) to install the app on an Axis device configured to allow unsigned apps.
3. The malicious app, once installed, exploits the input validation flaw to execute arbitrary code with elevated privileges.
4. Attacker gains persistent root access, can exfiltrate video feeds, modify device settings, or pivot to other network resources.

Affected Components: All Axis devices running ACAP that support unsigned application installation. Specific firmware versions are not yet identified.

Vulnerable vs. Patched Code

No patch is currently available. The vulnerable code is in the ACAP runtime loader, which processes application metadata and parameters without proper validation.

Vulnerable Code (Conceptual):

// ACAP loader - vulnerable to input injection
void load_acap(char *app_path, char *params) {
    char cmd[256];
    snprintf(cmd, sizeof(cmd), "run_acap %s %s", app_path, params);
    system(cmd);  // No sanitization of params
}

Patched Code (Expected):

// Patched version with input validation
void load_acap(char *app_path, char *params) {
    if (!validate_path(app_path) || !validate_params(params)) {
        log_error("Invalid input");
        return;
    }
    char cmd[256];
    snprintf(cmd, sizeof(cmd), "run_acap %s %s", app_path, params);
    system(cmd);
}

Exploitation & Lab Setup

Red Team

Prerequisites:

• Axis device with unsigned ACAP installation enabled (default is disabled).
• Ability to deliver a malicious ACAP file to the victim (e.g., via email, USB, or web download).

Exploitation Steps:

1. Create a malicious ACAP application that exploits the input validation flaw. Example payload:

   // malicious_acap.c
   #include <stdio.h>
   #include <stdlib.h>
   void exploit() {
       // Elevate privileges and execute shell
       system("id > /tmp/pwned");
       system("chmod 777 /etc/passwd");
   }
   int main() {
       exploit();
       return 0;
   }
   

2. Compile the ACAP package (.eap file) using Axis SDK.
3. Host the malicious .eap file on a web server or deliver via social engineering.
4. Victim installs the app via Axis device web interface or API.
5. The app executes, escalating privileges and providing attacker access.

No public exploit code is available; this is a conceptual example.

Blue Team

Detection:

• Monitor for installation of unsigned ACAP applications via device logs.
• Use network monitoring to detect unusual outbound connections from Axis devices.
• Enable device hardening: disable unsigned app installation.

Hunting:

• Search for ACAP applications with suspicious names or unknown publishers.
• Review device logs for privilege escalation attempts (e.g., su or sudo usage).

Indicators of Compromise (IOCs)

• File Hashes: Unknown (no known malicious samples)
• Network Indicators: Outbound connections from Axis device to unknown IPs on ports 80/443 or custom ports.
• Device Logs: Entries indicating installation of unsigned ACAP apps, or unexpected privilege escalation events.
• Process Anomalies: Unusual processes running with root privileges on the Axis device.

Detection Engineering

YARA Rule

rule CVE_2025_6298_ACAP_Malicious {
    meta:
        description = "Detects malicious ACAP applications exploiting CVE-2025-6298"
        author = "Valters IT"
        date = "2025-04-10"
    strings:
        $s1 = "system(" ascii wide nocase
        $s2 = "exec(" ascii wide nocase
        $s3 = "popen(" ascii wide nocase
        $s4 = "ACAP" ascii wide nocase
    condition:
        all of ($s1,$s2,$s3) and $s4
}

Sigma Rule

title: Suspicious ACAP Installation or Execution
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects installation or execution of unsigned ACAP applications on Axis devices
logsource:
    product: axis
    service: device_logs
detection:
    selection:
        EventID: 1001  # Example: ACAP installation event
        AppType: "unsigned"
    condition: selection
falsepositives:
    - Legitimate unsigned apps from trusted sources (rare)
level: high

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-6298 - Axis ACAP Privilege Escalation - Outbound Connection"; flow:to_server; content:"|00 00 00 00|"; depth:4; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable unsigned ACAP application installation on all Axis devices (default is disabled; verify configuration).
2. Restrict physical and network access to Axis devices to trusted users only.
3. Monitor device logs for unauthorized ACAP installations.

Long-Term Fix:

• Apply vendor patch when released (monitor Axis security advisories).
• Implement application whitelisting for ACAP apps.
• Use network segmentation to isolate Axis devices from untrusted networks.

Workarounds:

• If unsigned apps are required, use a dedicated management VLAN and enforce strict access controls.
• Regularly audit installed ACAP applications.

Valters IT