FLIR Systems, Inc. vulnerabilities
Published CVEs affecting FLIR Systems, Inc. products: 10 record(s), with severity, exploitation and fixes.
FLIR Thermal Camera F/FC/PT/D 2FLIR AX8 Thermal Camera 2Brickstream 3D+ 1FLIR Brickstream 3D+ 1Thermal Traffic Cameras 1FLIR Thermal Camera F/FC/PT/D Stream 1FLIR Thermal Camera PT-Series 1FLIR Thermal Camera FC-S/PT 1
CVE-2017-20216
Critical · 9.8
CWE-78 Jan 7, 2026
FLIR Thermal Camera PT-Series firmware version 8.0.0.64 Unauthenticated Remote Command Injection
FLIR Thermal Camera PT-Series firmware version 8.0.0.64 contains multiple unauthenticated remote command injection vulnerabilities in the controllerFlirSystem.php script. Attackers can execute arbitrary system commands as root by exploiting unsanitized POST parameters in the execFlirSystem() function through shell_exec() calls. Exploitation evidence was observed by the Shadowserver Foundation on 2026-01-06 (UTC).
CVE-2017-20215
High · 8.8
CWE-78 Jan 7, 2026
FLIR Thermal Camera FC-S/PT firmware version 8.0.0.64 Authenticated OS Command Injection
FLIR Thermal Camera FC-S/PT firmware version 8.0.0.64 contains an authenticated OS command injection vulnerability that allows attackers to execute shell commands with root privileges. Authenticated attackers can inject arbitrary shell commands through unvalidated input parameters to gain complete control of the thermal camera system.
CVE-2017-20214
High · 7.5
CWE-798 Jan 7, 2026
FLIR Thermal Camera F/FC/PT/D firmware version 8.0.0.64 Hard-Coded SSH Credentials Vulnerability
FLIR Thermal Camera F/FC/PT/D firmware version 8.0.0.64 contains hard-coded SSH credentials that cannot be changed through normal camera operations. Attackers can leverage these persistent, unmodifiable credentials to gain unauthorized remote access to the thermal camera system.
CVE-2017-20213
High · 7.5
CWE-306 Jan 7, 2026
FLIR Thermal Camera F/FC/PT/D Stream 8.0.0.64 Unauthenticated Stream Disclosure
FLIR Thermal Camera F/FC/PT/D Stream firmware version 8.0.0.64 contains an unauthenticated vulnerability that allows remote attackers to access live camera streams without credentials. Attackers can exploit the vulnerability to view unauthorized thermal camera video feeds across multiple camera series without requiring any authentication.
CVE-2017-20212
Medium · 6.2
CWE-22 Jan 7, 2026
FLIR Thermal Camera F/FC/PT/D 8.0.0.64 Information Disclosure via File Reading
FLIR Thermal Camera F/FC/PT/D firmware version 8.0.0.64 contains an information disclosure vulnerability that allows unauthenticated attackers to read arbitrary files through unverified input parameters. Attackers can exploit the /var/www/data/controllers/api/xml.php readFile() function to access local system files without authentication.
CVE-2018-25140
High · 7.5
CWE-306 Dec 24, 2025
FLIR Thermal Traffic Cameras V1.01-0bb5b27 Unauthenticated Websocket Device Manipulation
FLIR thermal traffic cameras contain an unauthenticated device manipulation vulnerability in their WebSocket implementation that allows attackers to bypass authentication and authorization controls. Attackers can directly modify device configurations, access system information, and potentially initiate denial of service by sending crafted WebSocket messages without authentication.
CVE-2018-25139
High · 7.5
CWE-306 Dec 24, 2025
FLIR AX8 Thermal Camera 1.32.16 Unauthenticated RTSP Stream Disclosure
FLIR AX8 Thermal Camera 1.32.16 contains an unauthenticated vulnerability that allows remote attackers to access live video streams without credentials. Attackers can directly connect to the RTSP stream using tools like VLC or FFmpeg to view and record thermal camera footage.
CVE-2018-25138
Critical · 9.8
CWE-798 Dec 24, 2025
FLIR AX8 Thermal Camera 1.32.16 Hard-Coded Credentials Authentication Bypass
FLIR AX8 Thermal Camera 1.32.16 contains hard-coded SSH and web panel credentials that cannot be changed through normal camera operations. Attackers can exploit these persistent credentials to gain unauthorized shell access and login to multiple camera interfaces using predefined username and password combinations.
CVE-2018-25137
High · 7.5
CWE-306 Dec 24, 2025
FLIR Brickstream 3D+ 2.1.742.1842 Unauthenticated Config File Disclosure
FLIR Brickstream 3D+ 2.1.742.1842 contains an unauthenticated vulnerability in the ExportConfig REST API that allows attackers to download sensitive configuration files. Attackers can exploit the getConfigExportFile.cgi endpoint to retrieve system configurations, potentially enabling authentication bypass and privilege escalation.
CVE-2018-25136
High · 7.5
CWE-306 Dec 24, 2025
FLIR Brickstream 3D+ 2.1.742.1842 Unauthenticated RTSP Stream Disclosure
FLIR Brickstream 3D+ 2.1.742.1842 contains an unauthenticated vulnerability that allows remote attackers to access live video streams without credentials. Attackers can retrieve video stream images by directly accessing multiple image endpoints like middleImage.jpg, rightimage.jpg, and leftimage.jpg.