PT-2024-23203 · Flir · Flir Ax8

H0E4A0R1T · Published 2024-03-27 · Updated 2025-10-15 · CVE-2024-3013

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions FLIR AX8 versions up to 1.46.16

Description A critical issue affects the User Registration component, specifically the file /tools/test login.php?action=register. The manipulation leads to improper authorization, and the attack may be initiated remotely. The exploit has been disclosed to the public and may be used.

Recommendations For FLIR AX8 versions up to 1.46.16, consider disabling access to the /tools/test login.php?action=register endpoint until a patch is available. Restrict access to the User Registration component to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Improper Authorization

Incorrect Privilege Assignment

Weakness Enumeration

CWE-285

CWE-266

Related Identifiers

CVE-2024-3013

Affected Products

Flir Ax8

References · 11

• 🔥 https://h0e4a0r1t.github.io/2024/vulns/FLIR-AX8%20Fixed%20Thermal%20Cameras%20Register%20any%20user%20in%20the%20background--test_login.php.pdf · Exploit
• https://osv.dev/vulnerability/CVE-2024-3013 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-3013 · Security Note
• https://t.me/cveNotify/138762 · Telegram Post
• https://vuldb.com/?submit.301588 · Note
• https://t.me/cvenotify/125555 · Telegram Post
• https://vuldb.com/?ctiid.258299 · Note
• https://vuldb.com/?id.258299 · Note
• https://twitter.com/VulmonFeeds/status/1773222912788431226 · Twitter Post
• https://twitter.com/CVEnew/status/1773211508131963187 · Twitter Post
• https://twitter.com/RedPacketSec/status/1773655218816733461 · Twitter Post