CVE-2025-0361 is a username-enumeration vulnerability in the VAPIX Device Configuration SSH Management API that Axis Communications' network cameras expose: a remote attacker who sends crafted requests to the API can determine which usernames exist on the device without authenticating, information that can then feed follow-on password-guessing attacks. NVD has published its own Primary CVSS v3.1 score of 5.3 (medium), slightly higher than the 4.3 that Axis itself assigned, and Axis is not aware of any public exploitation.
Vulnerability summary
5.3
Medium
0.3%
EPSS score (FIRST)
No
CISA KEV catalog
2025-04-08
Published
Vulnerability ID: CVE-2025-0361 · Source: NVD
Affected components
| Component | CPE | Version range |
|---|---|---|
| Axis Communications network camera firmware (AXIS OS, VAPIX Device Configuration SSH Management API) | — | AXIS OS 11.11 through 12.2; fixed in AXIS OS Active track 12.3.56 and LTS 2024 track 11.11.141, per Axis security advisory CVE-2025-0361 |
What does this mean for affected devices?
CVE-2025-0361 (CWE-203, Observable Discrepancy) affects the VAPIX Device Configuration SSH Management API in AXIS OS, the firmware that runs Axis Communications' network cameras and encoders. NVD's description states: "During an annual penetration test conducted on behalf of Axis Communications, Truesec discovered a flaw in the VAPIX Device Configuration framework that allowed for unauthenticated username enumeration through the VAPIX Device Configuration SSH Management API" (NVD).
Axis's own security advisory describes the SSH Management API as the interface used to add and manage SSH users on a device, and states that AXIS OS versions 11.11 through 12.2 were affected; the issue is fixed in the Active track as of version 12.3.56 and in the LTS 2024 track as of version 11.11.141. Axis disclosed this CVE alongside a related, more severe issue (CVE-2025-0360, an incorrect privilege level in the VAPIX service account D-Bus API, rated 7.8) on 8 April 2025, and states it is not aware of this vulnerability being exploited (Axis Security Advisory CVE-2025-0361).
NVD has published its own Primary CVSS v3.1 score of 5.3 (medium), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N, source [email protected] — slightly higher than the Secondary score of 4.3 that Axis's own PSIRT ([email protected]) assigned using the same vector except for a stricter PR:L privileges-required value. Because NVD has completed and published its own analysis, this page shows NVD's Primary score as the confirmed headline severity rather than Axis's vendor figure (NVD).
This CVE is not listed in the CISA Known Exploited Vulnerabilities catalog as of catalog version 2026.11.06, and FIRST scores the probability of exploitation at 0.0034 (27.3rd percentile) as of 2026-11-07 (CISA KEV, FIRST EPSS).
Operators of affected Axis cameras should update to AXIS OS 12.3.56 (Active track) or 11.11.141 (LTS 2024 track) or later, and should avoid exposing device management interfaces, including SSH, directly to the internet.
Evidence
- During an annual penetration test conducted on behalf of Axis Communications, Truesec discovered a flaw in the VAPIX Device Configuration framework that allowed for unauthenticated username enumeration through the VAPIX Device Configuration SSH Management API. — NVD
- Affects AXIS OS 11.11 through 12.2; fixed in Active track 12.3.56 and LTS 2024 track 11.11.141; Axis states it is not aware of this vulnerability being exploited; disclosed alongside the related CVE-2025-0360. — Axis Security Advisory CVE-2025-0361
- NVD's own Primary CVSS v3.1 score is 5.3 (medium), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N; Axis's Secondary score is 4.3 with a stricter privileges-required value. — NVD
- Not present in the CISA KEV catalog as of catalog version 2026.11.06; EPSS score is 0.0034 (27.3rd percentile) as of 2026-11-07. — FIRST EPSS
Questions about this page?
