CVE-2025-10220criticalCWE-1104

CVE-2025-10220: critical vulnerability in AxxonSoft AxxonOne C-Werk

Outdated Third-Party NuGet Packages in AxxonSoft Axxon One VMS 2.0.0 through 2.0.4

Published · Updated

Follow this CVE+ Monitor AxxonOne C-Werk

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

28Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 9.3epss 0.7%
In short

AxxonSoft Axxon One VMS versions 2.0.0 to 2.0.4 use outdated third-party libraries with known security flaws, allowing remote attackers to execute malicious code or disable security protections. This happens because the software relies on unmaintained or vulnerable components that have not been updated.

Technical detail

CWE-1104 vulnerability affecting NuGet dependencies (Google.Protobuf, DynamicData, System.Runtime.CompilerServices.Unsafe, and others) in Axxon One VMS 2.0.0–2.0.4 on Windows. Remote attackers can exploit known vulnerabilities in these third-party packages to achieve arbitrary code execution or security feature bypass without authentication or user interaction required.

Summary generated and translated by AI from the official description.
Use of Unmaintained Third Party Components (CWE-1104) in the NuGet dependency components in AxxonSoft Axxon One VMS 2.0.0 through 2.0.4 on Windows allows a remote attacker to execute arbitrary code or bypass security features via exploitation of vulnerable third-party packages such as Google.Protobuf, DynamicData, System.Runtime.CompilerServices.Unsafe, and others.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Affected products
AxxonSoft · AxxonOne C-Werk
Related CVEs — AxxonSoft AxxonOne C-Werk

In the same product, most dangerous first.

CVE-2025-10226CRITICALPostgreSQL Upgrade from v10 to v17.4 in AxxonSoft Axxon One (C-Werk) 2.0.8 and earlier to Address Multiple VulnerabilitiesEPSS 0.6%CVE-2025-10225HIGHIncorrect Memory Allocation in OpenSSL-Based Session Module in AxxonSoft Axxon One (C-Werk)EPSS 0.4%CVE-2025-10224MEDIUMIncorrect Evaluation of LDAP Nested Groups during Login in AxxonSoft Axxon One (C-Werk)EPSS 0.3%CVE-2025-10223MEDIUMImproper Session Cleanup on Role Removal in Web Admin Panel in AxxonSoft Axxon One (C-Werk)EPSS 0.3%CVE-2025-10222MEDIUMSensitive Information Disclosure in Diagnostic Dumps in AxxonSoft Axxon One VMSEPSS 0.1%CVE-2025-10227MEDIUMLack of Encryption in Object Archive in AxxonSoft Axxon One (C-Werk) before 2.0.8EPSS 0.1%