PT-2026-1670 · Flir · Flir Thermal Camera Pt-Series

Published 2026-01-08 · Updated 2026-01-08 · CVE-2017-20216

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions FLIR Thermal Camera PT-Series firmware version 8.0.0.64

Description The FLIR Thermal Camera PT-Series firmware version 8.0.0.64 contains multiple unauthenticated remote command injection issues in the controllerFlirSystem.php script. Attackers can execute arbitrary system commands as root by exploiting unsanitized POST parameters in the execFlirSystem() function through shell exec() calls. The Shadowserver Foundation observed exploitation evidence on 2026-01-06 (UTC).

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2017-20216

Affected Products

Flir Thermal Camera Pt-Series

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2017-20216 · Security Note
• https://web.archive.org/web/20171011125811/https://flir.com/security/blog/details/?ID=87043 · Note
• https://exploit-db.com/exploits/42785 · Note
• https://t.me/cveNotify/148017 · Telegram Post
• https://cxsecurity.com/issue/WLB-2017090203 · Note
• https://packetstormsecurity.com/files/144321 · Note
• https://zeroscience.mk/en/vulnerabilities/ZSL-2017-5438.php · Note