FLIR Systems AX8 Cameras Command Injection (CVE-2025-5695)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(505191);
  script_version("1.3");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/04/21");

  script_cve_id("CVE-2025-5695");

  script_name(english:"FLIR Systems AX8 Cameras Command Injection (CVE-2025-5695)");

  script_set_attribute(attribute:"synopsis", value:
"The remote OT asset is affected by a vulnerability.");
  script_set_attribute(attribute:"description", value:
"A vulnerability has been found in Teledyne FLIR AX8 up to 1.46.16.
This impacts the function
subscribe_to_spot/subscribe_to_delta/subscribe_to_alarm of the file
/usr/www/application/models/subscriptions.php of the component
Backend. Such manipulation leads to command injection. It is possible
to launch the attack remotely. The exploit has been disclosed to the
public and may be used. Upgrading to version 1.49.16 will fix this
issue. It is suggested to upgrade the affected component. The vendor
points out: FLIR AX8 internal web site has been refactored to be able
to handle the reported vulnerabilities.

This plugin only works with Tenable.ot.
Please visit https://www.tenable.com/products/tenable-ot for more information.");
  script_set_attribute(attribute:"see_also", value:"https://flir.custhelp.com/app/account/fl_download_software");
# https://github.com/YZS17/CVE/blob/main/Command%20injection%20vulnerability%20in%20subscribe_to_delta()%20in%20FLIR%20AX8.md
# script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?05fd03ee");
# https://github.com/YZS17/CVE/blob/main/Command%20injection%20vulnerability%20in%20subscribe_to_spot()%20in%20FLIR%20AX8.md
# script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?54dfaf03");
  script_set_attribute(attribute:"see_also", value:"https://vuldb.com/?ctiid.311211");
  script_set_attribute(attribute:"see_also", value:"https://vuldb.com/?id.311211");
  script_set_attribute(attribute:"see_also", value:"https://vuldb.com/?submit.584532");
  script_set_attribute(attribute:"see_also", value:"https://vuldb.com/?submit.585715");
  script_set_attribute(attribute:"see_also", value:"https://vuldb.com/?submit.585716");
  script_set_attribute(attribute:"solution", value:
"Refer to the vendor advisory.");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:P/RL:O/RC:C");
  script_set_attribute(attribute:"cvss4_vector", value:"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N");
  script_set_attribute(attribute:"cvss4_threat_vector", value:"CVSS:4.0/E:P");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2025-5695");

  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");
  script_cwe_id(74, 77);

  script_set_attribute(attribute:"vuln_publication_date", value:"2025/06/05");
  script_set_attribute(attribute:"patch_publication_date", value:"2025/06/05");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/02/19");

  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:flir:flir_ax8_firmware");
  script_set_attribute(attribute:"generated_plugin", value:"former");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Tenable.ot");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("tenable_ot_api_integration.nasl");
  script_require_keys("Tenable.ot/FLIRSystems");

  exit(0);
}


include('tenable_ot_cve_funcs.inc');

get_kb_item_or_exit('Tenable.ot/FLIRSystems');

var asset = tenable_ot::assets::get(vendor:'FLIRSystems');

var vuln_cpes = {
    "cpe:/o:flir:flir_ax8_firmware" :
        {"versionEndIncluding" : "1.46.16", "versionStartIncluding" : "1.46.0", "family" : "AX8Cameras"}
};

tenable_ot::cve::compare_and_report(asset:asset, cpes:vuln_cpes, severity:SECURITY_WARNING);