CVE-2022-37061
All FLIR AX8 thermal sensor cameras version up to and including 1.46.16 are vulnerable to Remote Command Injection. Toho lze využít k vkládání a provádění libovolných příkazů shellu jako uživatel root prostřednictvím parametru id HTTP POST v koncovém bodu res.php. A successful exploit could allow the attacker to execute arbitrary commands on the underlying operating system with the root privileges.
MISC: http://packetstormsecurity.com/files/168114/FLIX-AX8-1.46.16-Remote-Command-Execution.html
MISC: http://packetstormsecurity.com/files/168116/FLIR-AX8-1.46.16-Traversal-Access-Control-Command-Injection-XSS.html
MISC: http://packetstormsecurity.com/files/169701/FLIR-AX8-1.46.16-Remote-Command-Injection.html
MISC: https://gist.github.com/Nwqda/9e16852ab7827dc62b8e44d6180a6899
MISC: https://www.flir.com/products/ax8-automation/
MISC: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2018-5491.php
CVE: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-37061
published: 18. 8. 2022
