PT-2022-23776 · Flir · Flir Ax8

Published 2022-08-18 · Updated 2025-10-17 · CVE-2022-37060

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions FLIR AX8 thermal sensor cameras version up to and including 1.46.16

Description The issue is related to Directory Traversal due to improper access restriction. An unauthenticated, remote attacker can exploit this by sending a URI that contains directory traversal characters to disclose the contents of files located outside of the server's restricted path.

Recommendations For FLIR AX8 thermal sensor cameras version up to and including 1.46.16, update to a version later than 1.46.16 to resolve the issue. As a temporary workaround, consider restricting access to the server to minimize the risk of exploitation. Avoid using URIs that contain directory traversal characters in the affected API endpoint until the issue is resolved.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2022-37060

Affected Products

Flir Ax8

References · 8

• 🔥 https://gist.github.com/Nwqda/9e16852ab7827dc62b8e44d6180a6899 · Exploit
• 🔥 http://packetstormsecurity.com/files/168116/FLIR-AX8-1.46.16-Traversal-Access-Control-Command-Injection-XSS.html · Exploit
• https://flir.com/products/ax8-automation · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-37060 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-37060 · Security Note
• https://t.me/cibsecurity/48360 · Telegram Post
• https://zeroscience.mk/en/vulnerabilities/ZSL-2018-5493.php · Note
• https://t.me/cveNotify/139246 · Telegram Post