CVE-2023-29861

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

An issue found in FLIR-DVTEL version not specified allows a remote attacker to execute arbitrary code via a crafted request to the management page of the device.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-94

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://github.com/Duke1410/CVE/blob/main/CVE-2023-29861Third Party Advisory
https://woolly-espadrille-ed5.notion.site/The-FLIR-DVTEL-camera-device-has-a-logic-flaw-vulnerability-363a2158e372440b80a2be739271c6f3Exploit, Third Party Advisory
https://github.com/Duke1410/CVE/blob/main/CVE-2023-29861Third Party Advisory
https://woolly-espadrille-ed5.notion.site/The-FLIR-DVTEL-camera-device-has-a-logic-flaw-vulnerability-363a2158e372440b80a2be739271c6f3Exploit, Third Party Advisory

Timeline

Published: May 15, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-298629.8An issue found in Agasio-Camera device version not specified allows a remote attacker to execute arbitrary code via the check and authLevel CVE-2023-298639.8Medical Systems Co. Medisys Weblab Products v19.4.03 was discovered to contain a SQL injection vulnerability via the tem:statement parameter CVE-2023-298676.5Zammad 5.3.x (Fixed 5.4.0) is vulnerable to Incorrect Access Control. An authenticated attacker could gain information about linked accounts CVE-2023-298686.5Zammad 5.3.x (Fixed in 5.4.0) is vulnerable to Incorrect Access Control. An authenticated attacker with agent and customer roles could perfo CVE-2023-29879.8The Wordapp plugin for WordPress is vulnerable to authorization bypass due to an use of insufficiently unique cryptographic signature on the CVE-2023-298816.5phpok 6.4.003 is vulnerable to SQL injection in the function index_f() in phpok64/framework/api/call_control.php.CVE-2023-298877.5A Local File inclusion vulnerability in test.php in spreadsheet-reader 0.5.11 allows remote attackers to include arbitrary files via the Fil CVE-2023-29899.1Fortra Globalscape EFT versions before 8.1.0.16 suffer from an out of bounds memory read in their administration server, which can allow an CVE-2023-29907.5Fortra Globalscape EFT versions before 8.1.0.16 suffer from a denial of service vulnerability, where a compressed message that decompresses CVE-2023-299054.9H3C Magic R200 version R200V100R004 was discovered to contain a stack overflow via the UpdateSnat interface at /goform/aspForm.CVE-2023-299064.9H3C Magic R200 version R200V100R004 was discovered to contain a stack overflow via the Edit_BasicSSID interface at /goform/aspForm.CVE-2023-299074.9H3C Magic R200 version R200V100R004 was discovered to contain a stack overflow via the Edit_BasicSSID_5G interface at /goform/aspForm.