PT-2022-23777 · Flir · Flir Ax8

Published 2022-08-18 · Updated 2025-10-17 · CVE-2022-37061

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions FLIR AX8 thermal sensor cameras version up to and including 1.46.16

Description The issue allows for Remote Command Injection, which can be exploited to inject and execute arbitrary shell commands as the root user through the id HTTP POST parameter in the "res.php" endpoint. A successful exploit could allow the attacker to execute arbitrary commands on the underlying operating system with root privileges.

Recommendations For FLIR AX8 thermal sensor cameras version up to and including 1.46.16, consider disabling access to the "res.php" endpoint until a patch is available. As a temporary workaround, restrict the use of the id parameter in the HTTP POST requests to minimize the risk of exploitation.

Exploit

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2022-37061

Affected Products

Flir Ax8

References · 18

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/flir_ax8_unauth_rce_cve_2022_37061.rb · Exploit
• 🔥 https://zeroscience.mk/en/vulnerabilities/ZSL-2018-5491.php · Exploit
• 🔥 https://gist.github.com/Nwqda/9e16852ab7827dc62b8e44d6180a6899 · Exploit
• 🔥 https://exploit-db.com/exploits/52240 · Exploit
• 🔥 http://packetstormsecurity.com/files/168116/FLIR-AX8-1.46.16-Traversal-Access-Control-Command-Injection-XSS.html · Exploit
• 🔥 https://github.com/WlX-33/PoC-for-CVE/blob/main/CVE-2022-36266/FLIR%20AX8%20Unauthenticated%20OS%20Command%20Injection.py · Exploit
• 🔥 http://packetstormsecurity.com/files/169701/FLIR-AX8-1.46.16-Remote-Command-Injection.html · Exploit
• 🔥 http://packetstormsecurity.com/files/168114/FLIX-AX8-1.46.16-Remote-Command-Execution.html · Exploit
• https://flir.com/products/ax8-automation · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-37061 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-37061 · Security Note
• https://twitter.com/syedaquib77/status/1912603753003516391 · Twitter Post
• https://t.me/cveNotify/139247 · Telegram Post
• https://t.me/aptreports/4510 · Telegram Post
• https://t.me/cibsecurity/48367 · Telegram Post