FLIR Systems AX8 Cameras Command Injection (CVE-2022-4364)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(505195);
  script_version("1.2");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/02/20");

  script_cve_id("CVE-2022-4364");

  script_name(english:"FLIR Systems AX8 Cameras Command Injection (CVE-2022-4364)");

  script_set_attribute(attribute:"synopsis", value:
"The remote OT asset is affected by a vulnerability.");
  script_set_attribute(attribute:"description", value:
"A vulnerability has been found in Teledyne FLIR AX8 up to 1.46.16.
Affected by this issue is some unknown functionality of the file
palette.php of the component Web Service Handler. The manipulation of
the argument palette leads to command injection. The attack is
possible to be carried out remotely. The exploit has been disclosed to
the public and may be used. Upgrading to version 1.49.16 can resolve
this issue. Upgrading the affected component is advised. The vendor
points out: FLIR AX8 internal web site has been refactored to be able
to handle the reported vulnerabilities.

This plugin only works with Tenable.ot.
Please visit https://www.tenable.com/products/tenable-ot for more information.");
  # https://github.com/siriuswhiter/VulnHub/blob/main/Flir/02-FLIR-AX8%20palette.php%20%E5%91%BD%E4%BB%A4%E6%89%A7%E8%A1%8C%E6%BC%8F%E6%B4%9E/FLIR-AX8%20palette.php%20%E5%91%BD%E4%BB%A4%E6%89%A7%E8%A1%8C%E6%BC%8F%E6%B4%9E1.md
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?63571f1c");
  script_set_attribute(attribute:"see_also", value:"https://vuldb.com/?ctiid.215118");
  script_set_attribute(attribute:"see_also", value:"https://vuldb.com/?id.215118");
  script_set_attribute(attribute:"see_also", value:"https://vuldb.com/?submit.55748");
  # https://github.com/siriuswhiter/VulnHub/blob/main/Flir/02-FLIR-AX8%20palette.php%20%E5%91%BD%E4%BB%A4%E6%89%A7%E8%A1%8C%E6%BC%8F%E6%B4%9E/FLIR-AX8%20palette.php%20%E5%91%BD%E4%BB%A4%E6%89%A7%E8%A1%8C%E6%BC%8F%E6%B4%9E1.md
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?63571f1c");
  script_set_attribute(attribute:"see_also", value:"https://vuldb.com/?id.215118");
  script_set_attribute(attribute:"solution", value:
"Refer to the vendor advisory.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:P/RL:O/RC:C");
  script_set_attribute(attribute:"cvss4_vector", value:"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N");
  script_set_attribute(attribute:"cvss4_threat_vector", value:"CVSS:4.0/E:P");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2022-4364");

  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");
  script_cwe_id(74, 77, 78);

  script_set_attribute(attribute:"vuln_publication_date", value:"2022/12/08");
  script_set_attribute(attribute:"patch_publication_date", value:"2022/12/08");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/02/19");

  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:flir:flir_ax8_firmware");
  script_set_attribute(attribute:"generated_plugin", value:"former");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Tenable.ot");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("tenable_ot_api_integration.nasl");
  script_require_keys("Tenable.ot/FLIRSystems");

  exit(0);
}


include('tenable_ot_cve_funcs.inc');

get_kb_item_or_exit('Tenable.ot/FLIRSystems');

var asset = tenable_ot::assets::get(vendor:'FLIRSystems');

var vuln_cpes = {
    "cpe:/o:flir:flir_ax8_firmware" :
        {"versionEndExcluding" : "1.46.16", "versionStartIncluding" : "1.46.0", "family" : "AX8Cameras"}
};

tenable_ot::cve::compare_and_report(asset:asset, cpes:vuln_cpes, severity:SECURITY_HOLE);