EUVD-2025-18762Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Requires low privileges, network attack, low impact.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
7DescriptionCVE.org
A vulnerability was detected in Teledyne FLIR AX8 up to 1.46. Affected by this vulnerability is an unknown functionality of the file /upload.php. Performing manipulation of the argument File results in unrestricted upload. It is possible to initiate the attack remotely. The exploit is now public and may be used. Upgrading to version 1.49.16 addresses this issue. Upgrading the affected component is recommended. The vendor points out: "FLIR AX8 internal web site has been refactored to be able to handle the reported vulnerabilities."
AnalysisAI
Unauthenticated file upload vulnerability in Teledyne FLIR AX8 thermal cameras up to version 1.46 allows remote attackers to upload arbitrary files via the /upload.php endpoint. Public exploit code is available, and while the CVSS 4.0 score is low (2.1) due to required privileges, the EPSS score of 0.11% suggests low exploitation probability. No active exploitation has been reported in CISA KEV.
Technical ContextAI
The vulnerability resides in the /upload.php script of the FLIR AX8 internal web server, which handles file uploads without proper authentication or validation. The CWE-284 (Improper Access Control) indicates that the upload functionality lacks authorization checks, allowing any authenticated user (or potentially unauthenticated, though CVSS requires PR:L) to upload files. The CPE cpe:2.3:o:flir:flir_ax8_firmware:*:*:*:*:*:*:*:* confirms the affected component is the firmware of the FLIR AX8 device. The tags 'PHP', 'Authentication Bypass', and 'File Upload' highlight the technology and attack vector.
RemediationAI
Upgrade to FLIR AX8 firmware version 1.49.16, which addresses the vulnerability by refactoring the internal web site. No workarounds are documented; however, restricting network access to the device's web interface (e.g., via firewall rules) can mitigate remote exploitation. Note that blocking /upload.php may disrupt legitimate functionality.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today