CVE-2025-30024 describes a flaw in the communication protocol of Axis device_manager that enables man-in-the-middle attacks. With a CVSS score of 6.8 (Medium), this vulnerability requires high attack complexity and user interaction, but successful exploitation could lead to high confidentiality and integrity impacts. There is currently no public exploit code available (Metasploit, Nuclei, ExploitDB), and it is not listed in CISA's KEV catalog, indicating no active exploitation. Despite limited community discussion, the vulnerability has garnered media attention, suggesting some awareness within the security community.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
< 5.32.137CPE matchmatch criteria | cpe:2.3:a:axis:device_manager:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.2 Bluesky, 0.0 Mastodon, and 0.2 GitHub mentions.
The average CVE in this peer group has 0.2 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.