CVE-2025-10220
Published: 10 September 2025
Summary
CVE-2025-10220 is a critical-severity Use of Unmaintained Third Party Components (CWE-1104) vulnerability in Axxonsoft Axxon One. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 24.4% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SA-22 (Unsupported System Components) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly prohibits the use of unmaintained third-party components like the vulnerable NuGet packages in Axxon One VMS, preventing exploitation.
Requires timely identification, reporting, and correction of flaws in unmaintained components, addressing the arbitrary code execution and security bypass risks.
Enables periodic vulnerability scanning to identify exploitable flaws in unmaintained third-party NuGet dependencies such as Google.Protobuf.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Vulnerability in public-facing VMS enables remote arbitrary code execution via unmaintained third-party components.
NVD Description
Use of Unmaintained Third Party Components (CWE-1104) in the NuGet dependency components in AxxonSoft Axxon One VMS 2.0.0 through 2.0.4 on Windows allows a remote attacker to execute arbitrary code or bypass security features via exploitation of vulnerable third-party packages…
more
such as Google.Protobuf, DynamicData, System.Runtime.CompilerServices.Unsafe, and others.
Deeper analysisAI
CVE-2025-10220, published on 2025-09-10, is a Use of Unmaintained Third Party Components vulnerability (CWE-1104) in the NuGet dependency components of AxxonSoft Axxon One VMS versions 2.0.0 through 2.0.4 on Windows. The flaw arises from reliance on vulnerable third-party packages, including Google.Protobuf, DynamicData, System.Runtime.CompilerServices.Unsafe, and others, which are no longer maintained.
The vulnerability carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating it is exploitable over the network with low complexity, no privileges, and no user interaction required. A remote attacker can leverage the unmaintained components to execute arbitrary code or bypass security features in affected Axxon One VMS installations.
Mitigation guidance is available in AxxonSoft's security advisory at https://www.axxonsoft.com/legal/axxonsoft-vulnerability-disclosure-policy/security-advisories.
Details
- CWE(s)