CVE-2022-37061

Severity CVSS v4.0:
Pending analysis
Type:
CWE-78 OS Command Injections
Publication date:
18/08/2022
Last modified:
31/03/2025

Description

All FLIR AX8 thermal sensor cameras version up to and including 1.46.16 are vulnerable to Remote Command Injection. This can be exploited to inject and execute arbitrary shell commands as the root user through the id HTTP POST parameter in the res.php endpoint. A successful exploit could allow the attacker to execute arbitrary commands on the underlying operating system with the root privileges.

Vulnerable products and versions

CPE From Up to
cpe:2.3:o:flir:flir_ax8_firmware:*:*:*:*:*:*:*:* 1.46.16 (including)
cpe:2.3:h:flir:flir_ax8:-:*:*:*:*:*:*:*