Security Advisories

Advisory ID: CVE-2026-121020

• Title: User and Role Enumeration by Low-Privileged Users in Axxon One Security Configuration API
• Date Published: 2026-11-03
• Severity: Medium (CVSS 3.1: 4.3, CVSS 4.0: 5.3)
• Product Affected: Axxon One
• Affected Versions: All versions prior to 3.2.0
• Resolved Version: 3.2.0

Vulnerability Overview:
A request to the security configuration API returned the complete lists of user accounts and roles configured in the system to any authenticated user, regardless of that user's permissions. A user with limited privileges could use this information to enumerate accounts and roles.

Mitigation:
The server now returns only the data that the requesting user is permitted to see.

Recommendation:
Upgrade to Axxon One 3.2.0 or later.

Acknowledgments:
Reported by a customer's information security team.

Advisory ID: CVE-2026-121021

• Title: Plaintext Storage of LDAP Password in Axxon One Shared Configuration
• Date Published: 2026-11-03
• Severity: Medium (CVSS 3.1: 5.5, CVSS 4.0: 6.8)
• Product Affected: Axxon One
• Affected Versions: All versions prior to 3.1.0
• Resolved Version: 3.1.0

Vulnerability Overview:
When an LDAP directory was configured, the password of the LDAP service account was stored in plaintext in the shared configuration of the security service and in configuration backups. A local user with read access to the configuration directory or to the backups could obtain this password.

Mitigation:
Sensitive configuration values are now stored encrypted.

Recommendation:
Upgrade to Axxon One 3.1.0 or later. Change the password of the LDAP service account after the upgrade and treat configuration backups made with earlier versions as sensitive data.

Acknowledgments:
Reported by an AxxonSoft partner.

Advisory ID: CVE-2026-121022

• Title: Default Administrator Password Change Not Enforced in Axxon One Web Client
• Date Published: 2026-11-03
• Severity: High (CVSS 3.1: 8.1, CVSS 4.0: 9.2)
• Product Affected: Axxon One
• Affected Versions: All versions prior to 3.0.0
• Resolved Version: 3.0.0

Vulnerability Overview:
On a newly installed system, the web client allowed logging in as the built-in administrator with the default credentials without requiring the default password to be changed, unlike the desktop client. If the web server was reachable from the network before the password was changed, an unauthenticated attacker could gain administrator access.

Mitigation:
The web client now requires the default password to be changed on first login.

Recommendation:
Upgrade to Axxon One 3.0.0 or later. On earlier versions, change the default administrator password in the desktop client immediately after installation, before the web server is reachable from the network.

Acknowledgments:
Discovered internally by the AxxonSoft QA team.

Advisory ID: CVE-2026-121023

• Title: LDAP Bind Password Exposure in AxxonNet ARP Agent Logs
• Date Published: 2026-11-03
• Severity: Medium (CVSS 3.1: 5.5, CVSS 4.0: 6.8)
• Product Affected: AxxonNet ARP Agent
• Affected Versions: All versions prior to 3.25.0
• Resolved Version: 3.25.0 (delivered with Axxon One 2.0.16 and later)

Vulnerability Overview:
During directory user synchronization, the ARP Agent wrote WARNING-level log entries with serialized user data that included the plaintext password of the LDAP service account. Anyone with access to the ARP Agent log files or to support packages could obtain this password.

Mitigation:
TSensitive fields are now masked in ARP Agent logs.

Recommendation:
Upgrade the ARP Agent to version 3.25.0 or later. Change the password of the LDAP service account used for synchronization, and delete or restrict access to old ARP Agent log files and support packages.

Acknowledgments:
Discovered internally by the AxxonSoft development team.

Advisory ID: CVE-2026-121024

• Title: Read-Only Shared Token Allows Modification of Monitoring Alerts in AxxonNet
• Date Published: 2026-11-03
• Severity: Medium (CVSS 3.1: 5.4, CVSS 4.0: 5.3)
• Product Affected: AxxonNet (Health Monitoring)
• Affected Versions: All versions prior to 3.28.0
• Resolved Version: 3.28.0

Vulnerability Overview:
Shared report tokens are intended for read-only access to reports. The Health Monitoring service granted such tokens the permissions of the token owner, so a holder of a shared token could create, modify or delete monitoring alerts via the monitoring API.

Mitigation:
Shared tokens are now limited to read-only operations in Health Monitoring.

Recommendation:
Upgrade AxxonNet to version 3.28.0 or later. Revoke and reissue shared report tokens distributed before the upgrade, and review the monitoring alert configuration for unauthorized changes.

Acknowledgments:
Discovered internally by the AxxonSoft product team.

Advisory ID: CVE-2025-10221

• Title: Hardcoded Password Exposure in AxxonNet (C-Werk Net) ARP Agent Logs
• Date Published: 2024-08-20
• Severity: High
• Product Affected: AxxonNet (C-Werk Net) / ARP Agent
• Affected Versions: Axxon One (C-Werk) 2.0.4 and earlier with TRACE logging enabled
• Resolved Version: AxxonCloud (C-Werk Cloud) – Post 3.15.0 release

Vulnerability Overview:
When adding a domain to AxxonNet (C-Werk Net) Cloud with TRACE logging enabled, the agent logs exposed plaintext passwords in the system logs. This occurred within the serialized JSON payload recorded by arpagent.exe, creating a potential security and privacy breach.

Mitigation:
The TRACE log system was updated to mask password fields and use encoded_password only. This change ensures passwords are never exposed in logs.

Recommendation:
Update to version 3.15.0 or later. Avoid enabling TRACE logging in production unless required for debugging, and rotate credentials if logging was previously enabled.

Acknowledgments:
This vulnerability was discovered and resolved internally by AxxonSoft QA and engineering teams.

Advisory ID: CVE-2025-10220

• Title: Update of Third-Party NuGet Packages to Patch Vulnerable Dependencies
• Date Published: 2025-05-27
• Severity: Medium
• Product Affected: Axxon One (C-Werk)
• Affected Components: NuGet-based dependencies including Grpc, Protobuf, CefSharp, etc.

Vulnerability Overview:
Outdated versions of multiple NuGet packages contained known vulnerabilities or potential incompatibilities in certain environments (especially Linux).

Mitigation:
The following dependencies were updated:

• System.Runtime.CompilerServices.Unsafe → 6.1.2
• DynamicData → 9.3.2
• Google.Protobuf → 3.31.0
• CommandLineParser, Grpc.Tools, Microsoft.Bcl.AsyncInterfaces, CefSharp.*, prometheus-net and others upgraded to latest compatible stable releases.

grpc versions were tested and reverted due to environment-specific issues.

Recommendation:
Ensure deployment includes the updated versions listed above. Rebuild and retest dependent installers as part of post-upgrade verification.

Acknowledgments:
This vulnerability was addressed through the proactive efforts of AxxonSoft QA and development teams during scheduled stabilization sprints.

Advisory ID: CVE-2025-10222

• Title: Exposure of Licensing-Related Sensitive Information in Diagnostic Dumps
• Date Published: 2024-07-10
• Severity: Medium
• Product Affected: Axxon One (C-Werk)
• Affected Versions: Axxon One (C-Werk) 2.0.0 – 2.0.1
• Resolved Version: 2.0.2

Vulnerability Overview:
Sensitive internal variables, including license validation data, were unintentionally exposed in diagnostic output collected by the built-in troubleshooting tool. Although direct credential leakage was not observed, internal logic values such as timestamps, license state, and registry values were present in plaintext.

Mitigation:
The dump collection utility was updated to exclude sensitive registry and memory content. Internal validation logic was refactored to separate sensitive data from support-exported traces.

Recommendation:
Customers are advised to upgrade to version 2.0.2 or later. Diagnostic files previously sent to third parties should be reviewed and deleted if necessary.

Acknowledgments:
Reported and resolved by AxxonSoft’s internal QA team as part of routine license module hardening.

Advisory ID: CVE-2025-10223

• Title: Improper Session Cleanup on Role Removal in Web Admin Panel
• Date Published: 2024-10-12
• Severity: Medium
• Product Affected: Axxon One (C-Werk)
• Affected Versions: All versions prior to 2.0.3
• Resolved Version: 2.0.3

Vulnerability Overview:
When a user’s role is removed while they are still logged into the Web UI, their current session remains valid, allowing continued access until the session naturally expires. This creates a short-lived window where removed privileges are still active.

Mitigation:
The Web UI now forces immediate logout when user-role changes occur. Admins are notified of all forced logouts via system log.

Recommendation:
Upgrade to version 2.0.3 or later. For earlier versions, administrators are advised to manually log out affected users when changing access rights.

Acknowledgments:
Identified internally during access control regression testing.

Advisory ID: CVE-2025-10224

• Title: Incorrect Evaluation of LDAP Nested Groups during Login
• Date Published: 2025-01-19
• Severity: Medium
• Product Affected: Axxon One (C-Werk)
• Affected Versions: Axxon One (C-Werk) 2.0.2 and earlier
• Resolved Version: 2.0.2

Vulnerability Overview:
The LDAP authentication engine failed to fully resolve nested group memberships when evaluating access permissions, resulting in legitimate users being denied access or being misassigned roles.

Mitigation:
LDAP resolution logic was updated to recursively parse and flatten nested group structures before evaluating role binding.

Recommendation:
Upgrade to version 2.0.2 or newer. Ensure external LDAP directory structures are regularly audited for correct nesting and role mapping.

Acknowledgments:
Resolved by the AxxonSoft QA and directory integration teams.

Advisory ID: CVE-2025-10225

• Title: Incorrect Memory Allocation in OpenSSL-Based Session Module
• Date Published: 2024-11-01
• Severity: High
• Product Affected: Axxon One (C-Werk)
• Affected Versions: Axxon One (C-Werk) 2.0.6 and earlier
• Resolved Version: Migrated to OpenSSL 3.0.13

Vulnerability Overview:
A legacy compatibility shim used for session encryption introduced memory reallocation issues when handling expired keys. Under high load, this could result in crashes or unpredictable behavior.

Mitigation:
Session key management was refactored. All OpenSSL bindings were updated, and key refresh logic simplified to avoid reallocations in critical path.

Recommendation:
Recompile and deploy using OpenSSL 3.0.13 or later. Ensure proper handling of session key rotation in live environments.

Acknowledgments:
Reported during internal performance and fault-injection testing.

Advisory ID: CVE-2025-10226

• Title: PostgreSQL Upgrade from v10 to v17.4 to Address CVEs and Improve DB Hardening
• Date Published: 2025-03-08
• Severity: High
• Product Affected: Axxon One (C-Werk)
• Affected Versions: Axxon One (C-Werk) 2.0.8 and earlier
• Resolved Version: PostgreSQL 17.4

Vulnerability Overview:
The migration from PostgreSQL 10.x to 17.4 addressed over a dozen CVEs, including privilege escalation, remote code execution, and denial-of-service vulnerabilities.

Mitigation:
Full migration tested and applied to embedded and external PostgreSQL backends. Queries and schema adjustments validated.

Recommendation:
Administrators using external PostgreSQL instances are strongly advised to update to v17.4 or newer. See release notes for full CVE list.

Acknowledgments:
Implemented by the AxxonSoft DevOps and QA security team.

Advisory ID: CVE-2025-10227

• Title: Added Support for AES-256 Encryption of Object Archive
• Date Published: 2025-05-01
• Severity: High
• Product Affected: Axxon One (C-Werk) Object Archive
• Affected Versions: All versions before 2.0.8
• Resolved Version: 2.0.8

Vulnerability Overview:
Object archive data was previously stored without encryption, posing a risk of unauthorized extraction from exported storage or stolen physical drives.

Mitigation:
AES-256 encryption for object archive was implemented as part of core platform improvements. Encryption keys are protected by user credentials and can be rotated.

Recommendation:
Upgrade to version 2.0.8 or later. Enable encryption in archive storage settings and periodically rotate keys.

Acknowledgments:
Security improvement delivered by the AxxonSoft storage engineering group.