CVE-2022-37060

FLIR AX8 thermal sensor cameras version up to and including 1.46.16 is vulnerable to Directory Traversal due to an improper access restriction. An unauthenticated, remote attacker can exploit this by sending a URI that contains directory traversal characters to disclose the contents of files located outside of the server's restricted path.
Path Traversal
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
7.5 HIGH
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
mitreCNA
---
---
CVEADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 89%
VendorProductVersion
flirflir_ax8_firmware
𝑥
≤ 1.46.16
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
http://packetstormsecurity.com/files/168116/FLIR-AX8-1.46.16-Traversal-Access-Control-Command-Injection-XSS.html
https://gist.github.com/Nwqda/9e16852ab7827dc62b8e44d6180a6899
https://www.flir.com/products/ax8-automation/
https://www.zeroscience.mk/en/vulnerabilities/ZSL-2018-5493.php
http://packetstormsecurity.com/files/168116/FLIR-AX8-1.46.16-Traversal-Access-Control-Command-Injection-XSS.html
https://gist.github.com/Nwqda/9e16852ab7827dc62b8e44d6180a6899
https://www.flir.com/products/ax8-automation/
https://www.zeroscience.mk/en/vulnerabilities/ZSL-2018-5493.php