CVE-2022-37061

Related Files

FLIR AX8 1.46.16 Remote Command Injection

Posted Nov 2, 2022

Authored by Samy Younsi, Thomas Knudsen, h00die-gr3y | Site metasploit.com

All FLIR AX8 thermal sensor cameras versions up to and including 1.46.16 are vulnerable to remote command injection. This can be exploited to inject and execute arbitrary shell commands as the root user through the id HTTP POST parameter in the res.php endpoint. This module uses the vulnerability to upload and execute payloads gaining root privileges.

tags | exploit, remote, web, arbitrary, shell, root, php

advisories | CVE-2022-37061

SHA-256 | a321cd3e8960e684cbab1cd82bb0f9be0cda474af87c57e7f89fa9aaa83b6bca

Download | Favorite | View

FLIR AX8 1.46.16 Traversal / Access Control / Command Injection / XSS

Posted Aug 19, 2022

Authored by Samy Younsi, Thomas Knudsen

FLIR AX8 versions 1.46.16 and below suffer from command injection, directory traversal, improper access control, and cross site scripting vulnerabilities.

tags | exploit, vulnerability, xss, file inclusion

advisories | CVE-2022-37060, CVE-2022-37061, CVE-2022-37062, CVE-2022-37063

SHA-256 | d4b0fa3d39bb7d9eb67520d399557821deb5682ab4e0f91e473b5af510fec4d7

Download | Favorite | View