{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2025-0325", "assignerOrgId": "f2daf9a0-02c2-4b83-a01d-63b3b304b807", "state": "PUBLISHED", "assignerShortName": "Axis", "dateReserved": "2025-01-08T09:38:51.961Z", "datePublished": "2025-06-02T07:36:55.800Z", "dateUpdated": "2025-06-02T13:25:19.277Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "AXIS OS", "vendor": "Axis Communications AB", "versions": [{"lessThan": "6.50.5.21", "status": "affected", "version": "6.50.0", "versionType": "semver"}, {"lessThan": "8.40.74", "status": "affected", "version": "7.0.0", "versionType": "semver"}, {"lessThan": "9.80.100", "status": "affected", "version": "9.0.0", "versionType": "semver"}, {"lessThan": "10.12.278", "status": "affected", "version": "10.0.0", "versionType": "semver"}, {"lessThan": "11.11.142", "status": "affected", "version": "11.0.0", "versionType": "semver"}, {"lessThan": "12.4.28", "status": "affected", "version": "12.0.0", "versionType": "semver"}]}], "credits": [{"lang": "en", "type": "finder", "value": "51l3nc3"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "A Guard Tour VAPIX API parameter allowed the use of arbitrary values and can be incorrectly called, allowing an attacker to block access to the guard tour configuration page in the web interface of the Axis device."}], "value": "A Guard Tour VAPIX API parameter allowed the use of arbitrary values and can be incorrectly called, allowing an attacker\u00a0to block access to the guard tour configuration page in the web interface of the Axis device."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-1287", "description": "CWE-1287: Improper Validation of Specified Type of Input", "lang": "en", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-628", "description": "CWE-628: Function Call with Incorrectly Specified Arguments", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "f2daf9a0-02c2-4b83-a01d-63b3b304b807", "shortName": "Axis", "dateUpdated": "2025-06-02T07:36:55.800Z"}, "references": [{"url": "https://www.axis.com/dam/public/d0/ae/fe/cve-2025-0325pdf-en-US-483808.pdf"}], "source": {"discovery": "UNKNOWN"}, "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-06-02T13:21:58.179166Z", "id": "CVE-2025-0325", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-06-02T13:25:19.277Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-0325", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-06-02T13:21:58.179166Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-06-02T13:22:23.523Z"}}], "cna": {"source": {"discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "finder", "value": "51l3nc3"}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Axis Communications AB", "product": "AXIS OS", "versions": [{"status": "affected", "version": "6.50.0", "lessThan": "6.50.5.21", "versionType": "semver"}, {"status": "affected", "version": "7.0.0", "lessThan": "8.40.74", "versionType": "semver"}, {"status": "affected", "version": "9.0.0", "lessThan": "9.80.100", "versionType": "semver"}, {"status": "affected", "version": "10.0.0", "lessThan": "10.12.278", "versionType": "semver"}, {"status": "affected", "version": "11.0.0", "lessThan": "11.11.142", "versionType": "semver"}, {"status": "affected", "version": "12.0.0", "lessThan": "12.4.28", "versionType": "semver"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://www.axis.com/dam/public/d0/ae/fe/cve-2025-0325pdf-en-US-483808.pdf"}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "A Guard Tour VAPIX API parameter allowed the use of arbitrary values and can be incorrectly called, allowing an attacker\u00a0to block access to the guard tour configuration page in the web interface of the Axis device.", "supportingMedia": [{"type": "text/html", "value": "A Guard Tour VAPIX API parameter allowed the use of arbitrary values and can be incorrectly called, allowing an attacker to block access to the guard tour configuration page in the web interface of the Axis device.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-1287", "description": "CWE-1287: Improper Validation of Specified Type of Input"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-628", "description": "CWE-628: Function Call with Incorrectly Specified Arguments"}]}], "providerMetadata": {"orgId": "f2daf9a0-02c2-4b83-a01d-63b3b304b807", "shortName": "Axis", "dateUpdated": "2025-06-02T07:36:55.800Z"}}}, "cveMetadata": {"cveId": "CVE-2025-0325", "state": "PUBLISHED", "dateUpdated": "2025-06-02T13:25:19.277Z", "dateReserved": "2025-01-08T09:38:51.961Z", "assignerOrgId": "f2daf9a0-02c2-4b83-a01d-63b3b304b807", "datePublished": "2025-06-02T07:36:55.800Z", "assignerShortName": "Axis"}, "dataVersion": "5.1"}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "A Guard Tour VAPIX API parameter allowed the use of arbitrary values and can be incorrectly called, allowing an attacker\u00a0to block access to the guard tour configuration page in the web interface of the Axis device."}], "id": "CVE-2025-0325", "lastModified": "2025-06-02T17:32:17.397", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "product-security@axis.com", "type": "Secondary"}]}, "published": "2025-06-02T08:15:20.767", "references": [{"source": "product-security@axis.com", "url": "https://www.axis.com/dam/public/d0/ae/fe/cve-2025-0325pdf-en-US-483808.pdf"}], "sourceIdentifier": "product-security@axis.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-628"}, {"lang": "en", "value": "CWE-1287"}], "source": "product-security@axis.com", "type": "Secondary"}]}

{}