CVE-2022-37061: flir ax8 firmware

csirt@kutim:~/threat-intel/cve/CVE-2022-37061

CVSS 9.8 · Critical EPSS 99,6%

Kerentanan Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') pada flir ax8 firmware. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

All FLIR AX8 thermal sensor cameras version up to and including 1.46.16 are vulnerable to Remote Command Injection. This can be exploited to inject and execute arbitrary shell commands as the root user through the id HTTP POST parameter in the res.php endpoint. A successful exploit could allow the attacker to execute arbitrary commands on the underlying operating system with the root privileges. NOTE: The vendor has stated that with the introduction of firmware version 1.49.16 (Jan 2023) the FLIR AX8 should no longer be affected by the vulnerability reported. Latest firmware version (as of Oct 2025, was released Jun 2024) is 1.55.16.

Rincian

Terbit di NVD: 18 Agustus 2022
Terakhir diubah: 17 Juni 2026
Status NVD: Modified
CVSS 3.1: 9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
EPSS (30 hari): 99,6% peluang dieksploitasi; lebih tinggi dari 99,9% CVE lain

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
flir	flir ax8 firmware	Semua versi hingga 1.46.16

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

https://www.flir.com/products/ax8-automation/ product · advisory vendor
https://gist.github.com/Nwqda/9e16852ab7827dc62b8e44d6180a6899 exploit · mitigasi · advisory pihak ketiga
http://packetstormsecurity.com/files/168114/FLIX-AX8-1.46.16-Remote-Command-Execution.html exploit · advisory pihak ketiga · vdb entry
http://packetstormsecurity.com/files/168116/FLIR-AX8-1.46.16-Traversal-Access-Control-Command-Injection-XSS.ht... exploit · advisory pihak ketiga · vdb entry
http://packetstormsecurity.com/files/169701/FLIR-AX8-1.46.16-Remote-Command-Injection.html exploit · advisory pihak ketiga · vdb entry
https://www.zeroscience.mk/en/vulnerabilities/ZSL-2018-5491.php exploit · advisory pihak ketiga
https://github.com/WlX-33/PoC-for-CVE/blob/main/CVE-2022-36266/FLIR%20AX8%20Unauthenticated%20OS%20Command%20I...

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:10 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.