CVE-2025-13064

{"id": "CVE-2025-13064", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "product-security@axis.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.5, "attackVector": "ADJACENT_NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 0.9}]}, "published": "2026-02-10T06:15:54.170", "references": [{"url": "https://www.axis.com/dam/public/a9/9e/94/cve-2025-13064pdf-en-US-519290.pdf", "tags": ["Vendor Advisory"], "source": "product-security@axis.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "product-security@axis.com", "description": [{"lang": "en", "value": "CWE-248"}]}], "descriptions": [{"lang": "en", "value": "A server-side injection was possible for a malicious admin to manipulate the application to include a malicious script which is executed by the server. This attack is only possible if the admin uses a client that have been tampered with."}, {"lang": "es", "value": "Una inyecci\u00f3n del lado del servidor fue posible para que un administrador malicioso manipulara la aplicaci\u00f3n para incluir un script malicioso que es ejecutado por el servidor. Este ataque solo es posible si el administrador usa un cliente que ha sido manipulado."}], "lastModified": "2026-02-17T15:10:00.157", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:axis:camera_station_pro:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F257DBF0-2884-4BC6-9C49-5BDD1F0824EA", "versionEndExcluding": "6.14.10768"}], "operator": "OR"}]}], "sourceIdentifier": "product-security@axis.com"}