## https://sploitus.com/exploit?id=C5DEEE22-C2FE-5B07-9FD5-D2527B0F903E
# CVE-2025-0324 — Root Cause Analysis
**A client-controlled `Host` header as a root-group backdoor in the AXIS OS VAPIX Device Configuration framework.**
[](https://nvd.nist.gov/vuln/detail/CVE-2025-0324)
[%20%2F%208.8%20High%20(NVD)-b3261e)](https://nvd.nist.gov/vuln/detail/CVE-2025-0324)
[](https://cwe.mitre.org/data/definitions/791.html)
[](./LICENSE)
[](https://creativecommons.org/licenses/by/4.0/)
## TL;DR
Axis Communications disclosed CVE-2025-0324 on 2025-06-02 as a critical
(CVSS 9.4) privilege-escalation flaw in the VAPIX® Device Configuration
framework used across the AXIS OS platform, crediting bug-bounty researcher
**Malacupa** for the find — but explicitly declined to publish any
technical detail: *"Axis will not provide more detailed information about
the vulnerability."*
More than fourteen months after a patch became generally available, this
repository publishes an **independent root-cause reconstruction**, obtained
entirely through comparative firmware (patch-diff) analysis of publicly
distributed Axis firmware images, with the finding empirically confirmed on
real hardware the author owns.
**The bug, in one sentence:** an Apache authorization module shipped by
Axis (`mod_authz_axisgroupfile.so`) grants a session *every administrative
role it defines* if the client's `Host:` HTTP header resolves to the string
`localhost-acap` — and because the device runs Apache's default
`UseCanonicalName Off`, that value is fully attacker-controlled. Any
account with *any* valid, non-anonymous credential — including the
lowest-privileged `viewer` role — can become a full administrator by adding
one HTTP header.
This was demonstrated end-to-end on the author's own AXIS M4215-LV camera:
a `viewer`-role account, using only the header, created a real
administrator-only SSH user account (`HTTP 201 Created`), which was removed
immediately after confirmation.
## Contents of this repository
| Path | What it is |
|---|---|
| [`poc/verify_cve_2025_0324.py`](poc/verify_cve_2025_0324.py) | Safety-gated verification tool for device owners |
| [`poc/README.md`](poc/README.md) | Exact requests the tool sends, and its safety model |
| [`SECURITY.md`](SECURITY.md) | How to report issues with this repository's content or tooling |
Read the full report for: the disclosure timeline, affected version
ranges, the VAPIX Device Configuration framework's request-flow
architecture, the disassembly-level root cause with before/after code
listings, the live proof-of-concept transcripts, a discussion of why this
research supports NVD's `PR:LOW` CVSS assessment over the vendor's own
`PR:NONE` self-score, detection guidance for defenders, and full
remediation steps.
## Affected versions
| Track | Vulnerable | Fixed |
|---|---|---|
| AXIS OS LTS 2024 | ≥ 11.8.0, < 11.11.140 | 11.11.140 |
| AXIS OS Active Track | ≥ 12.0.0, < 12.3.33 | 12.3.33 |
**If you administer Axis devices, patch to the versions above (or your
model's next available build after 2025-06-02) before doing anything else.**
The verification tool in `poc/` can confirm your device's exposure in
read-only, non-destructive mode in under a second.
## Quick start (safe, read-only check)
```bash
cd poc
python3 -m venv .venv && source .venv/bin/activate
pip install -r requirements.txt
python3 verify_cve_2025_0324.py \
--target \
--username \
--password ''
```
This performs a firmware-version check plus a read-only behavioral test and
never modifies device state. See [`poc/README.md`](poc/README.md) for the
opt-in, fully conclusive (state-changing, auto-cleaning) confirmation mode,
and for exactly which HTTP requests are sent.
## Why this is being published now
- The vulnerability's existence, severity, and CVE identifier have been
public since 2025-06-02.
- A vendor patch has been generally available for the same period —
well over a year at time of writing.
- The vendor's advisory intentionally withheld the technical root cause,
and no public root-cause writeup or exploit appeared to exist prior to
this research.
- This document adds no new vulnerability and no new risk to unpatched
fleets beyond what the original advisory already signals; it exists to
help defenders detect exploitation, help laggard fleets prioritize
patching with full understanding of the actual risk, and to document an
instructive, subtle class of authorization bug (trusting
`ap_get_server_name()` — which reflects the client's `Host` header under
Apache's default configuration — for a security decision) for the wider
research community.
All testing was performed exclusively against hardware owned by the
author, on an isolated lab network, with no production systems or
third-party devices involved at any point. See §12 ("Ethics and
Disclosure") of the full report and [`SECURITY.md`](SECURITY.md) for more.
## Credits
- Vulnerability discovered and responsibly reported by **Malacupa**, via
the AXIS OS Bug Bounty Program.
- Axis Communications AB — [Security Advisory CVE-2025-0324, v1.0, 2025-06-02](https://www.axis.com/dam/public/04/f3/1c/cve-2025-0324pdf-en-US-483807.pdf).
- [NVD record for CVE-2025-0324](https://nvd.nist.gov/vuln/detail/CVE-2025-0324).
- This independent root-cause analysis: an anonymous independent security
researcher.
## License
- Code in [`poc/`](poc/) is licensed under the [MIT License](LICENSE).
- The written report (`report/report.html`, `report/report.pdf`, and this
README) is licensed under
[Creative Commons Attribution 4.0 International (CC BY 4.0)](https://creativecommons.org/licenses/by/4.0/).
You are free to share and adapt it, including commercially, provided you
give appropriate credit.
## Disclaimer
This repository is provided for defensive security research and asset-owner
self-verification purposes only. The author is not responsible for misuse.
Do not use any tool in this repository against a device you do not own or
are not explicitly authorized to test.