EUVD-2025-17027Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
PR:H due to admin auth required; C/I/A:H due to command injection impact.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
7DescriptionCVE.org
A vulnerability has been found in Teledyne FLIR AX8 up to 1.46.16. This impacts the function subscribe_to_spot/subscribe_to_delta/subscribe_to_alarm of the file /usr/www/application/models/subscriptions.php of the component Backend. Such manipulation leads to command injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 1.49.16 will fix this issue. It is suggested to upgrade the affected component. The vendor points out: "FLIR AX8 internal web site has been refactored to be able to handle the reported vulnerabilities."
AnalysisAI
Command injection in FLIR AX8 thermal camera firmware up to 1.46.16 allows remote authenticated attackers to execute arbitrary commands via the subscribe_to_spot, subscribe_to_delta, or subscribe_to_alarm functions in the backend. Public exploit code is available, and EPSS score (0.94%) indicates moderate exploitation likelihood, though no active exploitation in CISA KEV has been reported.
Technical ContextAI
The vulnerability resides in the PHP backend file /usr/www/application/models/subscriptions.php, which handles subscription requests for spot, delta, and alarm events. The CWE-74 (Injection) root cause is improper sanitization of user-supplied input passed to these functions, enabling command injection. The affected product is the FLIR AX8 thermal camera running firmware versions 1.46.x (up to 1.46.16). The CPE string cpe:2.3:o:flir:flir_ax8_firmware:*:*:*:*:*:*:*:* confirms the firmware as the affected component.
RemediationAI
Upgrade to firmware version 1.49.16, which refactors the internal web site to address the reported vulnerabilities. The vendor advisory can be accessed at https://flir.custhelp.com/app/account/fl_download_software. No workarounds are documented; restricting network access to the camera's web interface to trusted administrators only can reduce exposure.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Same technique Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today