Medium severity · published Feb 10, 2026
CVE-2025-12063
An insecure direct object reference allowed a non-admin user to modify or remove certain data objects without having the appropriate permissions
5.7
CVSS
0.2%
EPSS
No
On KEV
Description
An insecure direct object reference allowed a non-admin user to modify or remove certain data objects without having the appropriate permissions.
CVSS vector
CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Attack vector
Adjacent
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
None
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 6% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AC
AXIS Camera Station Pro · Axis Communications AB
6 before 6.14 · source: vendor
CS
Camera Station Pro · Axis
before 6.14.10768 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-12063
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-12063
Vendor Advisory
https://www.axis.com/dam/public/bc/f0/5a/cve-2025-12063pdf-en-US-519288.pdf
More from AXIS Camera Station Pro
7.8
CVE-2025-11547
AXIS Camera Station Pro contained a flaw to perform a privilege escalation attack on the server as a non-admin user
7.1
CVE-2026-63286
Database backups are vulnerable to offline attacks
6.3
CVE-2024-7696
Seth Fogie, member of AXIS Camera Station Pro Bug Bounty Program, has found that it is possible for an authenticated malicious client to tamper with audit log creation in AXIS…
4.6
CVE-2025-12757
An AXIS Camera Station Pro feature can be exploited in a way that allows a non-admin user to view information they are not permitted to
4.5
CVE-2025-13064
A server-side injection was possible for a malicious admin to manipulate the application to include a malicious script which is executed by the server