Zero Radar
← feed
HighVulnerabilityCVE-2026-63286updated 29 Oct 2026, 08:46 UTC

Axis Camera Station Pro backups expose stored camera credentials

Old database backups of Axis Camera Station Pro can be copied and read offline, which could reveal the passwords it stores for your cameras. Anyone who gets those backup files could potentially log into your cameras.

Fix availableOfficial, 2 sources
SeverityHighCVSS 7.1 of 10
Being exploited?UnclearNo reports either way yet
Fix available?YesUpdate AXIS Camera Station Pro to the patched version (exact version number not stated in the material). · since 29 Oct 2026
How sure is this?Official, 2 sourcesBacked by an official source

How the attack works simplified

  1. 1Attacker gets backupCopies an old backup file offline
  2. 2Backup decryptedStored credentials can be recovered
  3. 3Cameras exposedCamera logins become known to attacker
  4. ResultAttacker gains access to camera credentials

What happened

Database backups created by AXIS Camera Station Pro before the patched version remain vulnerable to offline attacks, exposing stored credentials. The software also creates an extra recovery backup when the update is applied, which is also vulnerable.

Why it is dangerous: An attacker who obtains these backup files may be able to decrypt the credentials for every connected camera, giving them access to your video and devices.

Are you affected?

You are affected if you run AXIS Camera Station Pro on a version earlier than the patched release and have backups created with it.

AXIS Camera Station Pro, versions prior to the patched version (exact version numbers not stated in the material); backups created with those versions, including the automatic recovery backup made during the update.

What to do

  1. Update AXIS Camera Station Pro to the patched version.
  2. Delete all old database backups, including the extra recovery backup created during the update.
  3. Change the credentials stored in AXIS Camera Station Pro, including your camera passwords.

Timeline

  1. 28 Oct 2026, 07:16 UTC
    Publicly disclosed
  2. 28 Oct 2026, 07:16 UTC
    Reported by NVD · NVD
  3. 28 Oct 2026, 07:18 UTC
    Picked up by Zero Radar
  4. 29 Oct 2026, 08:46 UTC
    r/netsec reported on it · r/netsec

Sources 2 reports, oldest first

Official vendor, government CERT or advisory database

Community discussion sites, treat with care

Technical details

ID
CVE-2026-63286
CVSS
7.1 / 10
EPSS
0.1% chance of exploitation within 30 days
Disclosed
28 Oct 2026, 07:16 UTC
On Zero Radar
28 Oct 2026, 07:18 UTC (2 min after disclosure)
Last change
29 Oct 2026, 08:46 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

Axis Camera Station Pro backups expose stored camera credentials · Zero Radar