A security researcher has publicly released proof-of-concept exploit code for a chain of three vulnerabilities in Axis Camera Station, the video management software widely used in commercial surveillance deployments. The most recently disclosed flaw, CVE-2026-63286, was assigned a CVSS score of 7.1 (High) and affects database backups created by both Axis Camera Station Pro and Axis Camera Station 5. The weakness — classified as inadequate encryption strength — means that anyone who obtains a backup file can extract the stored credentials for every camera managed by that server.
The researcher demonstrated during an authorized penetration test how two earlier flaws (CVE-2025-30026 and CVE-2025-30023, with a combined CVSS score up to 9.0 Critical) could first be used to gain system-level access to a Windows server running Camera Station, and then CVE-2026-63286 could be used to decrypt the camera credentials stored in the application database. Axis addressed the credential encryption weakness in Axis Camera Station Pro 6.20, released October 28. However, Axis has confirmed that Camera Station 5 will not receive a fix for CVE-2026-63286, meaning organizations running version 5 must migrate to Camera Station Pro 6.20 to fully address the issue. Axis has stated it is not aware of active exploitation in the wild.
Organizations running Axis Camera Station should confirm which version is deployed at each site. Those on Camera Station Pro should update to version 6.20, then delete any database backups created before the update and rotate the administrative credentials stored in the platform. Those on Camera Station 5 should plan migration to Camera Station Pro, as version 5 will remain unpatched for this flaw. Backups made prior to patching should be treated as potentially compromised and secured accordingly.
Does this affect your business?
Our advisors can help you figure out the right move, at no cost.