PT-2021-7251 · Infiray · Infiray Iray-A8Z3

F. Lienhart + 1 · Published 2021-02-01 · Updated 2022-07-25 · CVE-2022-31208

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Infiray IRAY-A8Z3 version 1.0.957

Description The issue is related to the webserver of the Infiray IRAY-A8Z3, which contains an endpoint that can execute arbitrary commands. This can be achieved by manipulating the cmd string URL parameter. The vulnerability is associated with incorrect code generation management, allowing an attacker to execute arbitrary code using the cmd string parameter.

Recommendations For Infiray IRAY-A8Z3 version 1.0.957, as a temporary workaround, consider restricting access to the vulnerable endpoint or disabling the use of the cmd string parameter until a patch is available. Avoid using the cmd string parameter in the affected API endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

BDU:2022-04176

CVE-2022-31208

Affected Products

Infiray Iray-A8Z3

References · 6

• https://bdu.fstec.ru/vul/2022-04176 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-31208 · Security Note
• https://infiray.com/infrared-security-database.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-31208 · Vendor Advisory
• https://sec-consult.com/vulnerability-lab/advisory/infiray-iray-thermal-camera-multiple-vulnerabilities · Note
• https://t.me/cvenotify/33701 · Telegram Post