📜 From RCE to camera credentials in Axis Camera Station https://ricardojoserf.github.io/axisrce/ During a penetration test, I exploited CVE-2025-30023 (insecure deserialization) chained with CVE-2025-30026 (authentication bypass) to get SYSTEM-level RCE on two Windows machines running Axis Camera Station on a factory. After that, I discovered CVE-2026-63286, a weak credential encryption scheme, which allowed me to decrypt all the camera credentials stored in the application’s database and connect to the cameras. Full attack chain summary: • Identify Axis Camera Station on port 55752 during the network scan. • Exploit CVE-2025-30026 + CVE-2025-30023 to get unauthenticated RCE as SYSTEM on both Windows servers, getting access to the factory network. • Copy the .FDB database files. • Exploit CVE-2026-63286 to decrypt all stored credentials. • Connect to the factory cameras using the decrypted credentials. Unauth RCE on Axis Camera Station (ACS) https://github.com/ricardojoserf/axis-RCE Offline decryptor for AXIS Camera Station (ACS) credentials https://github.com/ricardojoserf/CVE-2026-63286