← Voltar para CVEs

CVE-2025-5126

HIGH

8.8

Descricao

A vulnerability was found in Teledyne FLIR AX8 up to 1.46.16. This vulnerability affects the function setDataTime of the file \usr\www\application\models\settingsregional.php. Performing manipulation of the argument year/month/day/hour/minute results in command injection. The attack may be initiated remotely. The exploit has been made public and could be used. Upgrading to version 1.49.16 is able to resolve this issue. Upgrading the affected component is recommended. The vendor points out: "FLIR AX8 internal web site has been refactored to be able to handle the reported vulnerabilities."

Detalhes CVE

Pontuacao CVSS v3.18.8

SeveridadeHIGH

Vetor CVSSCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Vetor de ataqueNETWORK

ComplexidadeLOW

Privilegios necessariosLOW

Interacao do usuarioNONE

Publicado5/24/2025

Ultima modificacao10/15/2025

Fontenvd

Avistamentos honeypot0

Produtos afetados

flir:flir_ax8flir:flir_ax8_firmware

Fraquezas (CWE)

CWE-74CWE-77CWE-77

Referencias

https://github.com/YZS17/CVE/blob/main/Remote%20Command%20Injection%20in%20parameter%20%24hour.md(cna@vuldb.com)

https://github.com/YZS17/CVE/blob/main/Remote%20Command%20Injection%20in%20parameter%20%24minute.md(cna@vuldb.com)

https://vuldb.com/?ctiid.310204(cna@vuldb.com)

https://vuldb.com/?id.310204(cna@vuldb.com)

https://vuldb.com/?submit.570725(cna@vuldb.com)

https://vuldb.com/?submit.572266(cna@vuldb.com)

https://vuldb.com/?submit.572275(cna@vuldb.com)

https://vuldb.com/?submit.572277(cna@vuldb.com)

https://github.com/YZS17/CVE/blob/main/Remote%20Command%20Injection%20in%20parameter%20%24minute.md(134c704f-9b21-4f2e-91b3-4a467353bcc0)

Correlacoes IOC

Sem correlacoes registradas

This product uses data from the NVD API but is not endorsed or certified by the NVD.