CVE-2025-8108

Executive Summary

CVE-2025-8108 is a privilege escalation vulnerability affecting Axis devices that support ACAP (Axis Camera Application Platform). The flaw resides in an ACAP configuration file that has improper permissions and lacks input validation. Successful exploitation requires the device to be configured to allow installation of unsigned ACAP applications and social engineering to convince a victim to install a malicious ACAP. If exploited, an attacker can escalate privileges on the device, potentially gaining full control. The CVSS score is 6.7 (Medium), and no public exploit or patch is currently available.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It is specific to the Axis ACAP ecosystem, which is a proprietary application platform for Axis network cameras and edge devices.

CVSS Breakdown & Threat Level

• CVSS Score: 6.7 (Medium)
• Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
• Attack Vector: Local (requires physical or network access to the device)
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: Required (victim must install malicious ACAP)
• Scope: Unchanged
• Confidentiality Impact: High
• Integrity Impact: High
• Availability Impact: High

Threat Level: Medium. Exploitation requires specific device configuration and user interaction, but the impact is severe.

Deep Dive & Mechanics

The vulnerability exists in the ACAP configuration file handling. ACAP applications are installed via a .eap file, which contains configuration data. The configuration file is stored with improper permissions (e.g., world-writable) and lacks input validation. This allows a malicious ACAP to modify the configuration file after installation, potentially altering system settings or injecting malicious code that runs with elevated privileges.

Root Cause:

• Improper Permissions (CWE-276): The configuration file is writable by non-privileged users or processes.
• Lack of Input Validation: The file content is not sanitized, allowing injection of arbitrary commands or settings.

Attack Flow:

1. Attacker crafts a malicious unsigned ACAP application.
2. Victim (with device configured to allow unsigned apps) installs the ACAP.
3. The malicious ACAP modifies the configuration file to escalate privileges (e.g., adding a new user to the admin group, or modifying startup scripts).
4. The attacker gains elevated access to the device.

Vulnerable vs. Patched Code

No patched code is available. The vulnerable code is in the ACAP runtime environment, which processes the configuration file. A hypothetical fix would involve:

• Setting restrictive permissions (e.g., 600) on the configuration file.
• Validating and sanitizing all input from the configuration file before processing.

Vulnerable Code (Conceptual):

// Vulnerable: No permission check, no input validation
void load_config(char *filename) {
    FILE *fp = fopen(filename, "r");
    char buffer[256];
    while (fgets(buffer, sizeof(buffer), fp)) {
        // Directly process buffer without validation
        process_command(buffer);
    }
    fclose(fp);
}

Patched Code (Conceptual):

// Patched: Validate permissions and sanitize input
void load_config(char *filename) {
    // Check file permissions
    struct stat st;
    stat(filename, &st);
    if (st.st_mode & S_IWOTH) {
        log_error("Config file is world-writable, aborting");
        return;
    }
    FILE *fp = fopen(filename, "r");
    char buffer[256];
    while (fgets(buffer, sizeof(buffer), fp)) {
        // Sanitize input
        if (is_valid_command(buffer)) {
            process_command(buffer);
        } else {
            log_error("Invalid config entry");
        }
    }
    fclose(fp);
}

Exploitation & Lab Setup

Red Team (Attacker)

Prerequisites:

• Axis device with unsigned ACAP installation enabled.
• Network access to the device (or physical access).
• Social engineering to convince victim to install the malicious ACAP.

Lab Setup:

1. Set up an Axis device (e.g., Axis P1365) with default settings.
2. Enable unsigned ACAP installation via the web interface: System Options -> Advanced -> ACAP -> Allow unsigned applications.
3. Create a malicious ACAP .eap file.

Exploitation Steps:

1. Craft a malicious ACAP that modifies the configuration file to add a new admin user.
2. Host the ACAP on a web server or deliver via USB.
3. Convince the victim to install the ACAP via the device web interface.
4. After installation, the malicious ACAP runs and escalates privileges.
5. Use the new admin credentials to access the device with full control.

Example Malicious ACAP Code (Conceptual):

# malicious_acap.py
import os
# Modify config file to add admin user
config_path = "/etc/axis/acap/config.ini"
with open(config_path, "a") as f:
    f.write("[users]\nadmin2=password123\n")
# Trigger privilege escalation
os.system("systemctl restart axis-manager")

Blue Team (Defender)

Detection:

• Monitor for installation of unsigned ACAP applications.
• Check file permissions on ACAP configuration files.
• Look for unexpected changes to system users or startup scripts.

Prevention:

• Disable unsigned ACAP installation on all Axis devices.
• Use signed ACAP applications only.
• Implement network segmentation to limit access to Axis devices.
• Regularly audit device configurations.

Indicators of Compromise (IOCs)

• File Hashes: (None available, but monitor for unknown .eap files)
• Network Traffic: Unusual outbound connections from Axis device to attacker-controlled IPs.
• System Changes: New user accounts added to admin group, modified configuration files in /etc/axis/acap/.
• Processes: Unexpected processes running with elevated privileges.
• Logs: Entries in device logs indicating installation of unsigned ACAP or privilege escalation attempts.

Detection Engineering

YARA Rule

rule CVE_2025_8108_Malicious_ACAP {
    meta:
        description = "Detects malicious ACAP files exploiting CVE-2025-8108"
        author = "Valters IT"
        date = "2025-04-10"
    strings:
        $config_mod = "config.ini" nocase
        $priv_esc = "admin" nocase
        $unsigned = "unsigned" nocase
    condition:
        $config_mod and $priv_esc and $unsigned
}

Sigma Rule

title: Detection of Unsigned ACAP Installation
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects installation of unsigned ACAP applications on Axis devices
logsource:
    product: axis
    service: acap
detection:
    selection:
        EventID: 1001
        ApplicationType: "unsigned"
    condition: selection
falsepositives:
    - Legitimate unsigned ACAP installations (if allowed)
level: high

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-8108 - Malicious ACAP Download"; flow:to_server,established; content:"|2e 65 61 70|"; nocase; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable unsigned ACAP installation on all Axis devices.
2. Review and restrict file permissions on ACAP configuration files.
3. Monitor for any unauthorized ACAP installations.

Long-term Fix:

• Apply vendor patch when available.
• Implement strict input validation and permission checks in ACAP runtime.
• Use signed ACAP applications only.

Workarounds:

• Network segmentation to isolate Axis devices.
• Enable logging and alerting for ACAP installation events.

Valters IT Signature This report was generated by Valters IT Cyber Threat Intelligence Division. For questions, contact threatintel@valtersit.com.