CVE-2022-37061

CVE-2022-37061 – FLIR AX8 RCE vulnerability (up to firmware 1.46.16) : The issue is an unauthenticated remote command injection via the POST parameter id to res.php, allowing an attacker to execute arbitrary shell commands as root. Public reports indicate exploitation in the wild (e.g., Metasploi...

CVE-2022-37060

The CVE-2022-37060 entry relates to Teledyne FLIR AX8 thermal sensor cameras affected up to firmware version 1.46.16. A directory traversal flaw arises from improper access restrictions, allowing an unauthenticated, remote attacker to disclose files outside the restricted server path by sending c...

CVE-2022-37062

The CVE-2022-37062 issue affects Teledyne FLIR AX8 thermal sensor cameras version up to and including 1.46.16, due to an insecure design from improper directory access restriction that allows an unauthenticated remote attacker to request a URI containing the path to the SQLite users database and ...

CVE-2022-37063

The connected sources confirm CVE-2022-37063 affects Teledyne FLIR AX8 thermal sensor cameras up to version 1.46.16, due to improper input sanitization that enables authenticated remote XSS in the web management interface. Successful exploits can execute arbitrary JavaScript in the victim’s brows...

CVE-2025-5126

CVE-2025-5126 concerns Teledyne FLIR AX8 devices (versions up to 1.46.16) where the vulnerable function is setDataTime in the file usr/www/application/models/settingsregional.php. Manipulating the arguments year, month, day, hour, or minute enables a remote command injection. Exploitation is poss...

CVE-2024-3013

The CVE-2024-3013 entry affects Teledyne FLIR AX8 (up to v1.46.16) in the User Registration component, specifically the /tools/test_login.php?action=register path. The root cause is an improper authorization vulnerability in an unknown function, allowing remote exploitation. Reports indicate the ...

CVE-2022-4364

The CVE-2022-4364 issue affects Teledyne FLIR AX8 devices with Web Service Handler, where manipulation of the palette.php palette parameter in an unknown function enables remote command injection. This vulnerability is exploitable over the network without authentication, and public proof-of-conce...

CVE-2023-51126

The CVE-2023-51126 vulnerability affects Teledyne FLIR AX8 cameras up to firmware version 1.46.16, due to a command injection in the /usr/www/res.php endpoint where the value parameter is injectable. Root cause: improper input handling allows remote command execution. Impact is high (full code ex...

CVE-2025-5127

The CVE-2025-5127 entry concerns Teledyne FLIR AX8 firmware versions up to 1.46.16. The issue arises from how /prod.php processes the cmd parameter, enabling remote cross-site scripting via input manipulation. Public disclosures exist, and exploitation is possible as described in the sources. A f...

CVE-2025-5695

Concluded: CVE-2025-5695 affects Teledyne FLIR AX8 Backend, specifically the subscribe_to_spot/subscribe_to_delta/subscribe_to_alarm paths in /usr/www/application/models/subscriptions.php. Root cause described as command injection that can be triggered remotely over the network; exploitation is d...

CVE-2023-51127

CVE-2023-51127 affects Teledyne FLIR AX8 thermal cameras (up to firmware 1.46.16). The vulnerability is a Directory Traversal due to improper access restrictions, allowing an unauthenticated, remote attacker to read arbitrary sensitive files by uploading a specially crafted symbolic-link file. Th...

CVE-2025-6266

The CVE concerns Teledyne FLIR AX8 firmware versions up to 1.46. Affected is the behavior of the /upload.php endpoint, where manipulating the File parameter enables unrestricted file upload. The vulnerability is exploitable remotely and the exploit is public. Remediation is upgrading to version 1...

CVE-2018-25138

CVE-2018-25138 affects FLIR AX8 Thermal Camera firmware 1.32.16. The issue is hard-coded SSH and web panel credentials that cannot be changed via normal camera operations, enabling an unauthenticated attacker to gain shell access and log in to multiple interfaces using predefined credentials. Imp...

CVE-2018-25139

CVE-2018-25139 affects the FLIR AX8 Thermal Camera (firmware 1.32.16). The vulnerability allows unauthenticated remote access to live RTSP streams, enabling attackers to view and record thermal footage without credentials. Demonstrated use via RTSP clients (e.g., VLC/FFmpeg) is noted in sources. ...