CVE-2023-51126

CRITICAL

9.8

Description

Command injection vulnerability in /usr/www/res.php in FLIR AX8 up to 1.46.16 allows attackers to run arbitrary commands via the value parameter. NOTE: The vendor has stated that with the introduction of firmware version 1.49.16 (Jan 2023) the FLIR AX8 should no longer be affected by the vulnerability reported. Latest firmware version (as of Oct 2025, was released Jun 2024) is 1.55.16.

Details CVE

Score CVSS v3.19.8

SeveriteCRITICAL

Vecteur CVSSCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Vecteur d'attaqueNETWORK

ComplexiteLOW

Privileges requisNONE

Interaction utilisateurNONE

Publie1/10/2024

Derniere modification10/17/2025

Sourcenvd

Observations honeypot0

Produits affectes

flir:flir_ax8flir:flir_ax8_firmware

Faiblesses (CWE)

CWE-77CWE-77

References

https://github.com/risuxx/CVE-2023-51126(cve@mitre.org)

https://github.com/risuxx/CVE-2023-51126(af854a3a-2127-422b-91ae-364da2661108)

Correlations IOC

Aucune correlation enregistree

This product uses data from the NVD API but is not endorsed or certified by the NVD.