CVE-2022-37060

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

FLIR AX8 thermal sensor cameras version up to and including 1.46.16 is vulnerable to Directory Traversal due to an improper access restriction. An unauthenticated, remote attacker can exploit this by sending a URI that contains directory traversal characters to disclose the contents of files located outside of the server's restricted path. NOTE: The vendor has stated that with the introduction of firmware version 1.49.16 (Jan 2023) the FLIR AX8 should no longer be affected by the vulnerability reported. Latest firmware version (as of Oct 2025, was released Jun 2024) is 1.55.16.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-22

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://packetstormsecurity.com/files/168116/FLIR-AX8-1.46.16-Traversal-Access-Control-Command-Injection-XSS.htmlExploit, Third Party Advisory, VDB Entry
https://gist.github.com/Nwqda/9e16852ab7827dc62b8e44d6180a6899Exploit, Mitigation, Third Party Advisory
https://www.flir.com/products/ax8-automation/Product, Vendor Advisory
https://www.zeroscience.mk/en/vulnerabilities/ZSL-2018-5493.phpThird Party Advisory
http://packetstormsecurity.com/files/168116/FLIR-AX8-1.46.16-Traversal-Access-Control-Command-Injection-XSS.htmlExploit, Third Party Advisory, VDB Entry
https://gist.github.com/Nwqda/9e16852ab7827dc62b8e44d6180a6899Exploit, Mitigation, Third Party Advisory
https://www.flir.com/products/ax8-automation/Product, Vendor Advisory
https://www.zeroscience.mk/en/vulnerabilities/ZSL-2018-5493.phpThird Party Advisory

Timeline

Published: Aug 18, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-370619.8All FLIR AX8 thermal sensor cameras version up to and including 1.46.16 are vulnerable to Remote Command Injection. This can be exploited to CVE-2022-370627.5All FLIR AX8 thermal sensor cameras version up to and including 1.46.16 are affected by an insecure design vulnerability due to an improper CVE-2022-370635.4All FLIR AX8 thermal sensor cameras versions up to and including 1.46.16 are vulnerable to Cross Site Scripting (XSS) due to improper input CVE-2022-370669.8H3C GR-1200W MiniGRW1A0V100R006 was discovered to contain a stack overflow via the function UpdateDDNS.CVE-2022-370679.8H3C GR-1200W MiniGRW1A0V100R006 was discovered to contain a stack overflow via the function UpdateWanParamsMulti.CVE-2022-370689.8H3C GR-1200W MiniGRW1A0V100R006 was discovered to contain a stack overflow via the function UpdateMacCloneFinal.CVE-2022-370699.8H3C GR-1200W MiniGRW1A0V100R006 was discovered to contain a stack overflow via the function UpdateSnat.CVE-2022-37075.5A double-free memory flaw was found in the Linux kernel. The Intel GVT-g graphics driver triggers VGA card system resource overload, causing CVE-2022-370709.8H3C GR-1200W MiniGRW1A0V100R006 was discovered to contain a command injection vulnerability via the param parameter at DelL2tpLNSList.CVE-2022-370719.8H3C GR-1200W MiniGRW1A0V100R006 was discovered to contain a stack overflow via the function UpdateOne2One.CVE-2022-370729.8H3C GR-1200W MiniGRW1A0V100R006 was discovered to contain a stack overflow via the function UpdateWanLinkspyMulti.CVE-2022-370739.8H3C GR-1200W MiniGRW1A0V100R006 was discovered to contain a stack overflow via the function UpdateWanModeMulti.