CVE-2025-11142

The VAPIX API mediaclip.cgi that did not have a sufficient input validation allowing for a possible remote code execution. This flaw can only be exploited after authenticating with an operator- or administrator- privileged service account.

Affected

Axis Communications AB · AXIS OS

CVSS v3.1 NVD

8.8 HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CVSS v3.1 AXIS

7.1 HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H

EPSS

0.56% chance of exploitation in the next 30 days, 46th percentile

Published

2026-02-10

Updated

2026-02-26

Proof-of-concept exploits (1)

• kemrec/cve-2025-11142-axis-mediaclip-rce0★ · 2026-09-01

Security advisories

• https://www.axis.com/dam/public/18/0e/90/cve-2025-11142pdf-en-US-519291.pdf

References

• CVE Record
• NVD entry

Related

• CVE-2025-0324