Researcher discloses Axis Camera Station flaws enabling host takeover

A public PoC exploit and vulnerability details have been disclosed for Axis Camera Station, outlining an attack chain that combines an authentication bypass, insecure deserialization and weak encryption to gain control of Windows hosts running the software. The researcher, Ricardo J. Ruiz Fernandez, published the details and PoC code, linking the chain to CVE-2025-30026, CVE-2025-30023 and CVE-2026-63286.

The advisory notes that the attacker can connect to the service on port 55752 without valid credentials thanks to the authentication bypass (CVE-2025-30026), then deliver a serialized payload in a LogOnAsync request to achieve SYSTEM-level code execution (CVE-2025-30023). After initial access, the attacker can attempt to decrypt stored camera passwords from the Firebird database using a weak key derivation that relies on static constants and the host’s NTFS Volume Serial Number, tracked as CVE-2026-63286.

Affected versions include AXIS Camera Station Pro prior to 6.20 for CVE-2026-63286 and prior to 6.9 for CVE-2025-30026 and CVE-2025-30023, as well as AXIS Camera Station 5 prior to all releases. Axis has issued patches, with a recommendation to upgrade to AXIS Camera Station Pro 6.20 or later; versions of AXIS Camera Station 5 will not receive a patch for CVE-2026-63286, requiring migration to Pro 6.20.

The PoC exploit is openly available, including a GitHub repository for the RCE chain and a credential decryption script, which Fernández asserts can recover all camera passwords. While there is no confirmation of active exploitation in the wild at the time of reporting, the advisory emphasises immediate mitigation for unpatched deployments.