PT-2022-23778 · Flir · Flir Ax8

Published 2022-08-18 · Updated 2025-10-17 · CVE-2022-37062

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions FLIR AX8 thermal sensor cameras version up to and including 1.46.16

Description The issue is due to an improper directory access restriction, allowing an unauthenticated, remote attacker to exploit it by sending a URI that contains the path of the SQLite users database and download it. A successful exploit could allow the attacker to extract usernames and hashed passwords.

Recommendations For versions up to and including 1.46.16, update to a version later than 1.46.16 to resolve the issue. As a temporary workaround, consider restricting access to the SQLite users database to minimize the risk of exploitation. Avoid using URIs that contain the path of the SQLite users database until the issue is resolved.

Exploit

Fix

Missing Authentication

Weakness Enumeration

CWE-306

Related Identifiers

CVE-2022-37062

Affected Products

Flir Ax8

References · 7

• 🔥 https://gist.github.com/Nwqda/9e16852ab7827dc62b8e44d6180a6899 · Exploit
• https://osv.dev/vulnerability/CVE-2022-37062 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-37062 · Security Note
• https://flir.com/products/ax8-automation · Vendor Advisory
• https://t.me/cibsecurity/48375 · Telegram Post
• https://t.me/cveNotify/139248 · Telegram Post
• http://packetstormsecurity.com/files/168116/FLIR-AX8-1.46.16-Traversal-Access-Control-Command-Injection-XSS.html · Note