FLIR Systems AX8 Cameras Cross-site Scripting (CVE-2025-5127)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(505188);
  script_version("1.3");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/04/21");

  script_cve_id("CVE-2025-5127");

  script_name(english:"FLIR Systems AX8 Cameras Cross-site Scripting (CVE-2025-5127)");

  script_set_attribute(attribute:"synopsis", value:
"The remote OT asset is affected by a vulnerability.");
  script_set_attribute(attribute:"description", value:
"A vulnerability was determined in Teledyne FLIR AX8 up to 1.46.16.
This issue affects some unknown processing of the file /prod.php.
Executing manipulation of the argument cmd can lead to cross site
scripting. The attack may be launched remotely. The exploit has been
publicly disclosed and may be utilized. Upgrading to version 1.49.16
is capable of addressing this issue. It is recommended to upgrade the
affected component. The vendor points out: FLIR AX8 internal web site
has been refactored to be able to handle the reported
vulnerabilities.

This plugin only works with Tenable.ot.
Please visit https://www.tenable.com/products/tenable-ot for more information.");
# https://github.com/YZS17/CVE/blob/main/XSS%20vulnerability%20in%20FLIR%20AX8.md
# script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?6bf5aa82");
  script_set_attribute(attribute:"see_also", value:"https://vuldb.com/?ctiid.310205");
  script_set_attribute(attribute:"see_also", value:"https://vuldb.com/?id.310205");
  script_set_attribute(attribute:"see_also", value:"https://vuldb.com/?submit.572265");
# https://github.com/YZS17/CVE/blob/main/XSS%20vulnerability%20in%20FLIR%20AX8.md
# script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?6bf5aa82");
  script_set_attribute(attribute:"solution", value:
"Refer to the vendor advisory.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:S/C:P/I:P/A:N");
  script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:P/RL:O/RC:C");
  script_set_attribute(attribute:"cvss4_vector", value:"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N");
  script_set_attribute(attribute:"cvss4_threat_vector", value:"CVSS:4.0/E:P");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2025-5127");

  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");
  script_cwe_id(79, 94);

  script_set_attribute(attribute:"vuln_publication_date", value:"2025/05/24");
  script_set_attribute(attribute:"patch_publication_date", value:"2025/05/24");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/02/19");

  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:flir:flir_ax8_firmware");
  script_set_attribute(attribute:"generated_plugin", value:"former");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Tenable.ot");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("tenable_ot_api_integration.nasl");
  script_require_keys("Tenable.ot/FLIRSystems");

  exit(0);
}


include('tenable_ot_cve_funcs.inc');

get_kb_item_or_exit('Tenable.ot/FLIRSystems');

var asset = tenable_ot::assets::get(vendor:'FLIRSystems');

var vuln_cpes = {
    "cpe:/o:flir:flir_ax8_firmware" :
        {"versionEndIncluding" : "1.46.16", "versionStartIncluding" : "1.46.0", "family" : "AX8Cameras"}
};

tenable_ot::cve::compare_and_report(asset:asset, cpes:vuln_cpes, severity:SECURITY_WARNING);