Axis Camera Station / Device Manager: code execution and authentication bypass flaws (CVE-2025-30023, CVE-2025-30026) fixed
CVE-2025-30023 CVE-2025-30024 CVE-2025-30025 CVE-2025-30026 CVE-2026-63286
Published 04/11/2026 02:20
Timeline
2 events over 7 d
- 28/10/2026ConfirmedCERT-FR advisories+7 d
- 04/11/2026 02:20Published on WatchtowerPro CISO
In short
CISA's advisory ICSA-25-352-08 lists four flaws in Axis Camera Station Pro, Camera Station and Device Manager, including a client-server protocol flaw that could let an authenticated user run code remotely. Fixes are Camera Station Pro 6.9 or later, Camera Station 5.58 or later and Device Manager 5.32 or later. CISA reports no known public exploitation targeting these flaws.
How bad is it
Critical. An attacker on the same network who has a low-privilege login could run their own code on the camera management server.
Confirmed by the vendor or a CERT - no exploitation reported yet.
Severity score
The worst of 5 CVEs · CVSS 3.1 from NVD, from axis.com, read 04/11/2026.
What an attacker needs
- Internet access to itSame network needed
- A loginA user account
- A user to clickNo
- Special settingsNo
Red helps the attacker, blue holds them back, grey is not published yet.
If it works, an attacker can
- Run their own code on the system
- Read the data it holds
- Change or delete that data
- Take it offline
Type: remote code execution.
A score is the worst case for the flaw, not a verdict on any one system. How we score · ReconX customers see which of their own systems are affected.
Affected versions
- CVE-2025-30023: Camera Station Pro before 6.9, Camera Station before 5.58, Device Manager before 5.32.
- CVE-2025-30024: Device Manager before 5.32.
- CVE-2025-30025: Camera Station Pro before 6.8, all Camera Station 5.x, Device Manager before 5.32.
- CVE-2025-30026: NVD lists Camera Station before 5.58.47195 and Camera Station Pro from 6.0.25729 up to, but not including, 6.9.47069.
What to do now
- Update to Camera Station Pro 6.9 or later, Camera Station 5.58 or later, and Device Manager 5.32 or later.
- If you run Camera Station 5.x and CVE-2025-30025 matters to you, move to Camera Station Pro 6.9 or later; no 5.x fix exists for it.
- Until updated, do not expose these systems to the internet and put them behind firewalls, away from business networks. These interim measures reduce exposure and do not make the server safe.
- If you see suspected malicious activity, follow your internal procedures and report it to your national CERT.
ReconX customers see the full notice - and their own systems
Our customers are alerted at every phase. Until a patch exists, the ReconX agent watches their servers from the inside for anomalies, and our outside view - the attacker's view - shows which systems to fix first.
In ReconX: the full analysis, 4 open questions, followed up as sources answer and all 5 sources with their dates. And technology matching: which of your systems run Axis Camera Station Pro, at which version, fixed or not - and what each one needs.
Main sources
Vulnérabilité dans Axis Camera Station Pro (28 octobre 2026) CERT · [NEU] [mittel] Axis Camera Station: Schwachstelle ermöglicht nicht spezifizierten Angriff CERT · [UPDATE] [kritisch] Axis Camera Station und Device Manager: Mehrere Schwachstellen CERT