CVE-2025-0324 — Root Cause Analysis

A client-controlled Host header as a root-group backdoor in the AXIS OS VAPIX Device Configuration framework.

TL;DR

Axis Communications disclosed CVE-2025-0324 on 2025-06-02 as a critical (CVSS 9.4) privilege-escalation flaw in the VAPIX® Device Configuration framework used across the AXIS OS platform, crediting bug-bounty researcher Malacupa for the find — but explicitly declined to publish any technical detail: "Axis will not provide more detailed information about the vulnerability."

More than fourteen months after a patch became generally available, this repository publishes an independent root-cause reconstruction, obtained entirely through comparative firmware (patch-diff) analysis of publicly distributed Axis firmware images, with the finding empirically confirmed on real hardware the author owns.

The bug, in one sentence: an Apache authorization module shipped by Axis (mod_authz_axisgroupfile.so) grants a session every administrative role it defines if the client's Host: HTTP header resolves to the string localhost-acap — and because the device runs Apache's default UseCanonicalName Off, that value is fully attacker-controlled. Any account with any valid, non-anonymous credential — including the lowest-privileged viewer role — can become a full administrator by adding one HTTP header.

Contents of this repository

Read the full report for: the disclosure timeline, affected version ranges, the VAPIX Device Configuration framework's request-flow architecture, the disassembly-level root cause with before/after code listings, the live proof-of-concept transcripts, a discussion of why this research supports NVD's PR:LOW CVSS assessment over the vendor's own PR:NONE self-score, detection guidance for defenders, and full remediation steps.

Affected versions

If you administer Axis devices, patch to the versions above (or your model's next available build after 2025-06-02) before doing anything else. The verification tool in poc/ can confirm your device's exposure in read-only, non-destructive mode in under a second.

Quick start (safe, read-only check)

cd poc
python3 -m venv .venv && source .venv/bin/activate
pip install -r requirements.txt

python3 verify_cve_2025_0324.py \
  --target <device-ip> \
  --username <any-valid-account> \
  --password '<password>'

This performs a firmware-version check plus a read-only behavioral test and never modifies device state. See poc/README.md for the opt-in, fully conclusive (state-changing, auto-cleaning) confirmation mode, and for exactly which HTTP requests are sent.

Why this is being published now

• The vulnerability's existence, severity, and CVE identifier have been public since 2025-06-02.
• A vendor patch has been generally available for the same period — well over a year at time of writing.
• The vendor's advisory intentionally withheld the technical root cause, and no public root-cause writeup or exploit appeared to exist prior to this research.
• This document adds no new vulnerability and no new risk to unpatched fleets beyond what the original advisory already signals; it exists to help defenders detect exploitation, help laggard fleets prioritize patching with full understanding of the actual risk, and to document an instructive, subtle class of authorization bug (trusting ap_get_server_name() — which reflects the client's Host header under Apache's default configuration — for a security decision) for the wider research community.

All testing was performed exclusively against hardware owned by the author, on an isolated lab network, with no production systems or third-party devices involved at any point. See §12 ("Ethics and Disclosure") of the full report and SECURITY.md for more.

Credits

• Vulnerability discovered and responsibly reported by Malacupa, via the AXIS OS Bug Bounty Program.
• Axis Communications AB — Security Advisory CVE-2025-0324, v1.0, 2025-06-02.
• NVD record for CVE-2025-0324.
• This independent root-cause analysis: an anonymous independent security researcher.

License

• Code in poc/ is licensed under the MIT License.
• The written report (report/report.html, report/report.pdf, and this README) is licensed under Creative Commons Attribution 4.0 International (CC BY 4.0). You are free to share and adapt it, including commercially, provided you give appropriate credit.

Disclaimer

This repository is provided for defensive security research and asset-owner self-verification purposes only. The author is not responsible for misuse. Do not use any tool in this repository against a device you do not own or are not explicitly authorized to test.