High severity · published Feb 10, 2026
CVE-2025-11547
AXIS Camera Station Pro contained a flaw to perform a privilege escalation attack on the server as a non-admin user
7.8
CVSS
0.2%
EPSS
No
On KEV
Description
AXIS Camera Station Pro contained a flaw to perform a privilege escalation attack on the server as a non-admin user.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 6% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AC
AXIS Camera Station Pro · Axis Communications AB
6.11 through 6.12 · source: vendor
CS
Camera Station Pro · Axis
before 6.13.55835 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-11547
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-11547
Vendor Advisory
https://www.axis.com/dam/public/permalink/253485/cve-2025-11547pdf-en-US_253485.pdf?noS3=1
More from AXIS Camera Station Pro
7.1
CVE-2026-63286
Database backups are vulnerable to offline attacks
6.3
CVE-2024-7696
Seth Fogie, member of AXIS Camera Station Pro Bug Bounty Program, has found that it is possible for an authenticated malicious client to tamper with audit log creation in AXIS…
5.7
CVE-2025-12063
An insecure direct object reference allowed a non-admin user to modify or remove certain data objects without having the appropriate permissions
4.6
CVE-2025-12757
An AXIS Camera Station Pro feature can be exploited in a way that allows a non-admin user to view information they are not permitted to
4.5
CVE-2025-13064
A server-side injection was possible for a malicious admin to manipulate the application to include a malicious script which is executed by the server