Public PoC Exploit Disclosed for Axis Camera Station RCE

TL;DR

Security researcher Ricardo J. Ruiz Fernandez publicly disclosed vulnerability details and proof-of-concept code for an Axis Camera Station RCE attack chain. The exploit chains an authentication bypass with insecure deserialization and weak encryption to compromise servers and decrypt camera credentials. System administrators should upgrade to AXIS Camera Station Pro 6.20 immediately to secure their video management deployments.

Why It Matters

Organizations deploy video management systems to monitor critical physical infrastructure. The researcher notes: “AXIS Camera Station is a popular video management software (VMS) used to manage Axis IP cameras and other devices.” Organizations worldwide rely on this platform to oversee physical security across factories, warehouses, and corporate facilities. According to internet scan data, thousands of video management servers remain reachable on internal and external enterprise networks.

Because technical details and functional exploit code are now public, unpatched installations face immediate risk. An attacker on the local network can take full control of the Windows host as SYSTEM and access surveillance feeds. Outside of the researcher’s authorized penetration test, security teams have confirmed no active exploitation in the wild.

How the Attack Works

The attack combines three distinct vulnerabilities across the network protocol and backend database.

Authentication Bypass and Remote Code Execution

The researcher published a public GitHub repository for the RCE exploit that targets port 55752. First, the exploit abuses CVE-2025-30026. The advisory states: “The authentication bypass (CVE-2025-30026) allows connecting to the service without valid credentials, the server accepts any self-signed client certificate.”

Next, the attacker abuses CVE-2025-30023 by sending a serialized payload inside the clientInformationDto field during a LogOnAsync request. The .NET serializer processes the payload and executes arbitrary commands with SYSTEM privileges on the Windows server. The researcher outlined this initial access flow in a detailed technical analysis of the attack chain.

Database Credential Decryption

After achieving execution, the attacker targets stored camera passwords to complete the Axis Camera Station RCE sequence. The software stores device credentials inside a Firebird database file.

The author examined the database logic. The advisory explains: “Reversing the key derivation in CA.Core.dll revealed the encryption key is derived from two hard-coded constants and the host’s NTFS Volume Serial Number, a non-secret 32-bit value.” Tracked as CVE-2026-63286 (CVSS 7.1), this weak encryption scheme relies on static DLL constants and a readable volume serial. The author published a credential decryption script repository that recovers all camera passwords instantly.

Affected Versions

CVE-2025-30026 and CVE-2025-30023 affect AXIS Camera Station Pro versions before 6.9 and AXIS Camera Station versions before 5.58. Furthermore, CVE-2026-63286 affects AXIS Camera Station Pro prior to version 6.20 and all releases of AXIS Camera Station 5.

Patch and Mitigation Steps

Axis Communications addressed the vulnerabilities in recent software updates. Administrators should visit the official Axis download portal and update to AXIS Camera Station Pro 6.20 or later.

However, Axis confirmed that AXIS Camera Station 5 will not receive a patch for CVE-2026-63286. Organizations running version 5 must migrate to AXIS Camera Station Pro 6.20. In addition, administrators should isolate video management systems on dedicated management VLANs and block port 55752 from untrusted segments.

×

Support Our Threat Intelligence

Find our vulnerability reports and weekly recaps helpful? Support our work today and unlock a 100% ad-free reading experience!

Buy Me a Coffee

PayPal

Select your plan

Free Pro Team

Hover over a plan to see its benefits.

Written by

@DdoS · Security Researcher

Do Son

Do Son is the Founder and Editor of SecurityOnline.info. Working in cybersecurity since 2013, he reports on vulnerabilities, malware, and emerging threats, providing timely analysis to help organizations and individuals stay ahead of evolving risks.