AxxonSoft vulnerabilities

Products

• Axxon One 11
• AxxonOne C-Werk 7
• AxxonNet 1
• AxxonNet ARP Agent 1
• AxxonNet ARP Agent C-WerkNet 1
• next 1

Latest AxxonSoft CVEs

Newest publication first

1. CVE-2026-121024 Read-Only Shared Token Allows Modification of Monitoring Alerts in AxxonNet

   Published 2026-11-03

   Medium·CVSS 5.3 EPSS 0.21%

   Incorrect Authorization (CWE-863) in the Health Monitoring service in AxxonSoft AxxonNet before 3.28.0 on Linux allows a remote attacker in possession of a shared report token, which is intended for read-only access, to create, modify or delete monitoring alerts via the monitorin...

2. CVE-2026-121023 LDAP Bind Password Exposure in AxxonNet ARP Agent Logs

   Published 2026-11-03

   Medium·CVSS 6.8 EPSS 0.10%

   Insertion of Sensitive Information into Log File (CWE-532) in the ARP Agent component in AxxonSoft AxxonNet before 3.25.0 on Windows and Linux allows a local attacker with read access to ARP Agent log files or support packages to obtain the plaintext password of the LDAP director...

3. CVE-2026-121022 Default Administrator Password Change Not Enforced in Axxon One Web Client

   Published 2026-11-03

   Critical·CVSS 9.2 EPSS 0.38%

   Use of Default Password (CWE-1393) in the web client in AxxonSoft Axxon One before 3.0.0 on Windows and Linux allows a remote unauthenticated attacker to log in as the built-in administrator with the default credentials on a newly installed system, because the web client did not...

4. CVE-2026-121021 Plaintext Storage of LDAP Password in Axxon One Shared Configuration

   Published 2026-11-03

   Medium·CVSS 6.8 EPSS 0.09%

   Plaintext Storage of a Password (CWE-256) in the SecurityManager shared configuration in AxxonSoft Axxon One before 3.1.0 on Windows and Linux allows a local attacker with read access to the configuration directory or to configuration backups to obtain the password of the LDAP di...

5. CVE-2026-121020 User and Role Enumeration by Low-Privileged Users in Axxon One Security Configuration API

   Published 2026-11-03

   Medium·CVSS 5.3 EPSS 0.22%

   Exposure of Sensitive Information to an Unauthorized Actor (CWE-200) in the security configuration API in AxxonSoft Axxon One before 3.2.0 on Windows and Linux allows a remote authenticated user with limited privileges to enumerate all user accounts and roles configured in the sy...

6. CVE-2025-10227 Lack of Encryption in Object Archive in AxxonSoft Axxon One (C-Werk) before 2.0.8

   Published 2025-09-10

   Medium·CVSS 5.1 EPSS 0.08%

   Missing Encryption of Sensitive Data (CWE-311) in the Object Archive component in AxxonSoft Axxon One (C-Werk) before 2.0.8 on Windows and Linux allows a local attacker with access to exported storage or stolen physical drives to extract sensitive archive data in plaintext via la...

7. CVE-2025-10226 PostgreSQL Upgrade from v10 to v17.4 in AxxonSoft Axxon One (C-Werk) 2.0.8 and earlier to Address Multiple Vulnerabilities

   Published 2025-09-10

   Critical·CVSS 9.3 EPSS 0.63%

   Dependency on Vulnerable Third-Party Component (CWE-1395) in the PostgreSQL backend in AxxonSoft Axxon One (C-Werk) 2.0.8 and earlier on Windows and Linux allows a remote attacker to escalate privileges, execute arbitrary code, or cause denial-of-service via exploitation of multi...

8. CVE-2025-10225 Incorrect Memory Allocation in OpenSSL-Based Session Module in AxxonSoft Axxon One (C-Werk)

   Published 2025-09-10

   High·CVSS 8.7 EPSS 0.40%

   Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119) in the OpenSSL-based session module in AxxonSoft Axxon One (C-Werk) 2.0.6 and earlier on Windows allows a remote attacker under high load conditions to cause application crashes or unpredictable beh...

9. CVE-2025-10224 Incorrect Evaluation of LDAP Nested Groups during Login in AxxonSoft Axxon One (C-Werk)

   Published 2025-09-10

   Medium·CVSS 5.3 EPSS 0.33%

   Improper Authentication (CWE-287) in the LDAP authentication engine in AxxonSoft Axxon One (C-Werk) 2.0.2 and earlier on Windows allows a remote authenticated user to be denied access or misassigned roles via incorrect evaluation of nested LDAP group memberships during login.

10. CVE-2025-10223 Improper Session Cleanup on Role Removal in Web Admin Panel in AxxonSoft Axxon One (C-Werk)

    Published 2025-09-10

    Medium·CVSS 5.3 EPSS 0.26%

    Insufficient Session Expiration (CWE-613) in the Web Admin Panel in AxxonSoft Axxon One (C-Werk) prior to 2.0.3 on Windows allows a local or remote authenticated attacker to retain access with removed privileges via continued use of an unexpired session token until natural expira...

11. CVE-2025-10222 Sensitive Information Disclosure in Diagnostic Dumps in AxxonSoft Axxon One VMS

    Published 2025-09-10

    Medium·CVSS 4.8 EPSS 0.12%

    Exposure of Sensitive Information to an Unauthorized Actor (CWE-200) in the diagnostic dump component in AxxonSoft Axxon One VMS (C-Werk) 2.0.0 through 2.0.1 on Windows allows a local attacker to obtain licensing-related information such as timestamps, license states, and registr...

12. CVE-2025-10221 Hardcoded Password Exposure in AxxonNet (C-WerkNet) ARP Agent Logs

    Published 2025-09-10

    Medium·CVSS 6.7 EPSS 0.13%

    Insertion of Sensitive Information into Log File (CWE-532) in the ARP Agent component in AxxonSoft Axxon One / AxxonNet / C-WerkNet 2.0.4 and earlier on Windows platforms allows a local attacker to obtain plaintext credentials via reading TRACE log files containing serialized JSO...

13. CVE-2025-10220 Outdated Third-Party NuGet Packages in AxxonSoft Axxon One VMS 2.0.0 through 2.0.4

    Published 2025-09-10

    Critical·CVSS 9.3 EPSS 0.74%

    Use of Unmaintained Third Party Components (CWE-1104) in the NuGet dependency components in AxxonSoft Axxon One VMS 2.0.0 through 2.0.4 on Windows allows a remote attacker to execute arbitrary code or bypass security features via exploitation of vulnerable third-party packages su...

14. CVE-2018-7467 AxxonSoft Axxon Next has Directory Traversal via an initial /css//..%2f substring in a URI.

    Published 2018-02-27

    High·CVSS 7.5 EPSS 10.2%

    AxxonSoft Axxon Next has Directory Traversal via an initial /css//..%2f substring in a URI.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.