Introduction
Privilege escalation and arbitrary code execution in enterprise video surveillance infrastructure can lead to unauthorized access, tampering with security footage, or complete system compromise. CVE-2025-10226 exposes AxxonSoft Axxon One 2.0.8 and earlier to these risks because the product relies on an outdated PostgreSQL backend. For organizations that manage critical physical security assets, this is a serious exposure.
About AxxonSoft and Axxon One: AxxonSoft is a global provider of video management software (VMS) and integrated security systems, with deployments in critical infrastructure, enterprise, and government. Axxon One is its flagship VMS platform. It supports large-scale surveillance, analytics, and integration with thousands of camera models, and it is widely used in environments where video integrity and system reliability matter most.
Technical information
CVE-2025-10226 is a dependency vulnerability in Axxon One 2.0.8 and earlier (Windows and Linux) that comes from its use of PostgreSQL v10.x as the backend database. PostgreSQL 10.x contains multiple critical vulnerabilities, several of which are actively exploited and resolved only in PostgreSQL 17.4.
Axxon One uses PostgreSQL for all metadata, configuration, and archive management. Because it embeds or requires PostgreSQL 10.x, it inherits every unpatched vulnerability in that version. Notable ones include:
- CVE-2025-8714: Arbitrary OS code execution via maliciously crafted pg_dump files. Attackers with database access can inject psql meta-commands into dump files, and those commands execute as the OS user during restoration (details).
- CVE-2025-8715: Code and SQL injection through improper newline handling in object names during dump/restore (analysis).
- CVE-2025-1094: SQL injection in the psql client, exploitable via crafted input (Rapid7 writeup).
- CVE-2019-10164: Stack-based buffer overflow in the password change routine, enabling code execution (CrunchyData).
- CVE-2018-10925: Memory disclosure via INSERT ... ON CONFLICT DO UPDATE with CREATE TABLE privilege (PostgreSQL Security).
- CVE-2017-12172: Privilege escalation to root via log file manipulation in startup scripts (PostgreSQL Security).
An attacker who gains database access, whether over the network, with compromised credentials, or through an application flaw, can use known exploits for these flaws to escalate privileges or execute arbitrary code on the server. The root cause is an unsupported, vulnerable PostgreSQL version, which exposes the application to all of its upstream flaws.
This summary includes no public code snippets or exploit PoCs.
Affected systems and versions
- Product: AxxonSoft Axxon One
- Affected versions: 2.0.8 and all earlier versions
- Platforms: Windows and Linux
- Database dependency: PostgreSQL v10.x (all minor versions)
- Vulnerable configurations:
- Any deployment (embedded or external PostgreSQL) using v10.x as the backend
- Both default and custom configurations, if PostgreSQL 10.x is present
- Fixed version: Upgrade to PostgreSQL 17.4 (requires Axxon One 2.0.9 or later for the embedded database)
Vendor security history
AxxonSoft runs a public security advisory program (advisories) and regularly addresses vulnerabilities in both its own code and third-party dependencies. Previous advisories have covered:
- OpenSSL dependency issues
- NuGet-based dependency vulnerabilities
- Encryption enhancements for object archives
AxxonSoft's response to CVE-2025-10226 was timely. It published advisory AXXON-SEC-2025-007 within months of the PostgreSQL 17.4 release. Its advisories include clear affected version ranges, mitigation steps, and validation of fixes. Still, the repeated dependency-related advisories point to ongoing difficulty managing supply-chain risk.
