Exploiting the Axis Remoting Protocol for Pre-Auth RCE

TLDR: Researchers discovered a critical chain of vulnerabilities in the Axis Remoting protocol, allowing unauthenticated attackers to achieve remote code execution on Axis Camera Station servers. By exploiting a combination of an authentication bypass via a hidden endpoint and a dangerous deserialization flaw, an attacker can gain full control over the management server and pivot to connected cameras. This research highlights the severe risks of implementing proprietary binary protocols over HTTP without rigorous security validation.

Security researchers often focus on the low-hanging fruit of web applications, but the real danger frequently hides in the proprietary binary protocols that manage critical infrastructure. The recent research into the Axis Remoting protocol is a masterclass in why "security through obscurity" is a failed strategy. By reverse-engineering the communication between Axis Camera Station clients and servers, researchers uncovered a path to full system compromise that bypasses standard authentication mechanisms entirely.

The Mechanics of the Axis Remoting Protocol

At its core, the Axis Remoting protocol is a proprietary binary protocol wrapped in mutual TLS (mTLS) and designed to facilitate communication between management clients and servers. The protocol relies on standard RPC-like patterns, where clients invoke methods on the server. Because the protocol is proprietary and lacks public documentation, it was long assumed to be a "black box" that was inherently secure.

The research team began by performing a man-in-the-middle (MITM) attack on the mTLS-encrypted traffic. By successfully intercepting and decrypting the communication, they identified that the protocol uses JSON-based RPC calls to trigger server-side functionality. The critical flaw lies in how the server handles these incoming requests. Specifically, the server uses TypeNameHandling.Auto in its JSON deserialization process. This is a classic deserialization vulnerability, as it allows an attacker to specify the type of object to be instantiated on the server. By crafting a malicious payload using YSoSerial.Net, an attacker can trigger arbitrary code execution on the server.

Bypassing Authentication

While the deserialization flaw provides the execution primitive, it initially appeared to require valid authentication credentials. The researchers discovered that the server enforces authentication via NTLM, which is standard for Windows-based environments. However, they identified a hidden, undocumented endpoint: /_/.

This endpoint, which does not require authentication, acts as a gateway to the underlying remoting functionality. By sending requests to this path, an attacker can initiate the protocol handshake without providing valid credentials. This effectively turns the deserialization vulnerability into a pre-authentication remote code execution (RCE) exploit. The attack flow is straightforward:

1. Connect to the target server on the appropriate port.
2. Send a request to the /_/ endpoint to bypass authentication.
3. Initiate the Axis Remoting protocol handshake.
4. Inject the malicious deserialization payload to execute arbitrary commands.

The impact of this vulnerability is massive. Because the management server is designed to control entire fleets of cameras, gaining RCE on the server allows an attacker to pivot directly into the camera network. This is a textbook example of T1190-exploit-public-facing-app leading to T1210-exploitation-of-remote-services.

Real-World Applicability and Impact

For a pentester, this finding is a goldmine. During an engagement, you should look for Axis Camera Station instances exposed to the internet. A quick scan using Shodan or Censys reveals thousands of these servers globally. If you encounter an instance, you are not just looking at a camera feed; you are looking at a potential entry point into a corporate or government network.

The vulnerability is tracked under several identifiers, including CVE-2025-30023, CVE-2025-30024, and CVE-2025-30026. These vulnerabilities demonstrate that even when vendors attempt to implement "secure" protocols, the underlying implementation details—like the choice of deserialization libraries—can undermine the entire security model.

Defensive Considerations

Defenders must prioritize patching these systems immediately. Axis has released firmware and software updates that address these flaws. Beyond patching, the most effective defense is to ensure that management interfaces for critical infrastructure are never exposed directly to the public internet. Use VPNs or zero-trust access proxies to restrict access to these services. Furthermore, implementing network segmentation is vital; even if the management server is compromised, the cameras themselves should be isolated from the rest of the corporate network to prevent lateral movement.

This research serves as a stark reminder that proprietary protocols are not inherently secure. If you are auditing a system that uses a custom binary protocol, do not assume it is safe just because you cannot read the traffic. Focus on the data handling and deserialization logic, as that is where the most dangerous vulnerabilities usually reside. The next time you see an Axis camera on a network, remember that the management server behind it might be the most vulnerable asset in the room.