{"id":"CVE-2025-0325","state":"PUBLISHED","title":"A Guard Tour VAPIX API parameter allowed the use of arbitrary values and can be incorrectly called, allowing an attacker to block access to the guard tour configuration page in the","description":"A Guard Tour VAPIX API parameter allowed the use of arbitrary values and can be incorrectly called, allowing an attacker to block access to the guard tour configuration page in the web interface of the Axis device.","publishedAt":"2025-06-02T07:36:55.800Z","updatedAt":"2025-06-02T13:25:19.277Z","severity":{"score":4.3,"label":"Medium","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","source":"Axis"},"assigner":"Axis","products":["Axis Communications AB AXIS OS"],"affected":[{"vendor":"Axis Communications AB","product":"AXIS OS","defaultStatus":"unaffected","versions":[{"version":"6.50.0","status":"affected","lessThan":"6.50.5.21","versionType":"semver"},{"version":"7.0.0","status":"affected","lessThan":"8.40.74","versionType":"semver"},{"version":"9.0.0","status":"affected","lessThan":"9.80.100","versionType":"semver"},{"version":"10.0.0","status":"affected","lessThan":"10.12.278","versionType":"semver"},{"version":"11.0.0","status":"affected","lessThan":"11.11.142","versionType":"semver"},{"version":"12.0.0","status":"affected","lessThan":"12.4.28","versionType":"semver"}]}],"references":["https://www.axis.com/dam/public/d0/ae/fe/cve-2025-0325pdf-en-US-483808.pdf"],"weaknesses":["CWE-1287","CWE-628"],"ingestedAt":"2026-10-29T20:08:20.985Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2025/0xxx/CVE-2025-0325.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2025-0325","state":"PUBLISHED","datePublished":"2025-06-02T07:36:55.800Z","dateUpdated":"2025-06-02T13:25:19.277Z","assignerShortName":"Axis","assignerOrgId":"f2daf9a0-02c2-4b83-a01d-63b3b304b807","dateReserved":"2025-01-08T09:38:51.961Z"},"containers":{"cna":{"descriptions":[{"lang":"en","value":"A Guard Tour VAPIX API parameter allowed the use of arbitrary values and can be incorrectly called, allowing an attacker to block access to the guard tour configuration page in the web interface of the Axis device."}],"affected":[{"vendor":"Axis Communications AB","product":"AXIS OS","defaultStatus":"unaffected","versions":[{"version":"6.50.0","status":"affected","lessThan":"6.50.5.21","versionType":"semver"},{"version":"7.0.0","status":"affected","lessThan":"8.40.74","versionType":"semver"},{"version":"9.0.0","status":"affected","lessThan":"9.80.100","versionType":"semver"},{"version":"10.0.0","status":"affected","lessThan":"10.12.278","versionType":"semver"},{"version":"11.0.0","status":"affected","lessThan":"11.11.142","versionType":"semver"},{"version":"12.0.0","status":"affected","lessThan":"12.4.28","versionType":"semver"}]}],"references":[{"url":"https://www.axis.com/dam/public/d0/ae/fe/cve-2025-0325pdf-en-US-483808.pdf"}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":4.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","version":"3.1"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-1287","description":"CWE-1287: Improper Validation of Specified Type of Input","lang":"en","type":"CWE"}]},{"descriptions":[{"cweId":"CWE-628","description":"CWE-628: Function Call with Incorrectly Specified Arguments","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"Axis","orgId":"f2daf9a0-02c2-4b83-a01d-63b3b304b807","dateUpdated":"2025-06-02T07:36:55.800Z"},"credits":[{"lang":"en","type":"finder","value":"51l3nc3"}],"source":{"discovery":"UNKNOWN"},"x_generator":{"engine":"Vulnogram 0.2.0"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2025-06-02T13:21:58.179166Z","id":"CVE-2025-0325","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2025-06-02T13:25:19.277Z"}}]}}}