TI-2026-81719 Aliases CVE-2026-63286 GHSA-7c4c-2f85-qf36

Weak encryption exposes AXIS Camera Station Pro database backups

LOW 32CWE-326Published 2026-10-28 · Updated 2026-11-05

Key facts

Attack vector: Local
Privileges required: Low
User interaction: None
Attack complexity: Low
Impact type: Information disclosure
Confidentiality · integrity · availability: High · High · None
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-326.

Summary

AXIS Camera Station Pro from 6.0 before 6.20 and AXIS Camera Station 5 from 5.00 are affected. Database backups use inadequate encryption strength (CWE-326), so their contents can be attacked offline. A local user with low privileges can read and modify the protected data. Backups created by an earlier version remain vulnerable after the update.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Description from the CNA

Database backups are vulnerable to offline attacks. Backups created using a version prior to the patched version are still vulnerable. AXIS Camera Station Pro automatically creates one more such backup for recovery purpose when the update is applied. Delete all these backups and change the credentials stored in AXIS Camera Station Pro.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00078 0th percentileScored 2026-11-07

Fix Fixed AXIS Camera Station Pro (Axis Communications AB): 6.20

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Axis Communications AB	AXIS Camera Station Pro	6.0 to before 6.20	6.20	Patch available	CNA
Axis Communications AB	AXIS Camera Station 5	5.00 and later	—	No fix listed	CNA

AXIS Camera Station Pro VendorAxis Communications AB Affected 6.0 to before 6.20 Fixed in 6.20 Patch available CNA
AXIS Camera Station 5 VendorAxis Communications AB Affected 5.00 and later Fixed in — No fix listed CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPE	Versions	Role	Vendor
cpe:2.3:a:axis:camera_station_pro::::::::	—	—	Axis Communications AB

cpe:2.3:a:axis:camera_station_pro:*:*:*:*:*:*:*:* Versions — — ·Axis Communications AB

Remediation

Update AXIS Camera Station Pro to 6.20. The sources list no fixed version for AXIS Camera Station 5. Delete all backups made before the update, including the recovery backup that AXIS Camera Station Pro creates during the update, and change the credentials stored in AXIS Camera Station Pro.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Fix · CNA AXIS Camera Station Pro (Axis Communications AB) Fixed in 6.20

Timeline

2026-10-28 Threatist record created from CVE-2026-63286
2026-10-28 Alias added: GHSA-7c4c-2f85-qf36
2026-10-28 Priority changed: MEDIUM → LOW
2026-11-05 CISA SSVC decision points changed

References

Other 1

https://www.axis.com/dam/public/c9/5c/29/cve-2026-63286pdf-en-US-560650.pdf

TI-2018-07542 An issue was discovered in multiple models of Axis IP Cameras. CVSS 3.0CRITICAL 9.8
TI-2018-07541 An issue was discovered in multiple models of Axis IP Cameras. CVSS 3.0CRITICAL 9.8
TI-2018-07543 An issue was discovered in multiple models of Axis IP Cameras. CVSS 3.0CRITICAL 9.8
TI-2003-00222 The web-based administration capability for various Axis Network Camera products allows… CVSS 2.0HIGH 10.0
TI-2015-06802 Multiple cross-site scripting (XSS) vulnerabilities in Axis network cameras. CVSS 3.0MEDIUM 6.1
TI-2000-00191 Axis StorPoint CD allows remote attackers to access administrator URLs without… CVSS 2.0HIGH 10.0

See all 123 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences