← voltar
CVE-2017-20216

FLIR Thermal Camera PT-Series firmware version 8.0.0.64 Unauthenticated Remote Command Injection

CVSS 9.3 CRITICALEPSS 10.6%CWE-78
FLIR Thermal Camera PT-Series firmware version 8.0.0.64 contains multiple unauthenticated remote command injection vulnerabilities in the controllerFlirSystem.php script. Attackers can execute arbitrary system commands as root by exploiting unsanitized POST parameters in the execFlirSystem() function through shell_exec() calls. Exploitation evidence was observed by the Shadowserver Foundation on 2026-01-06 (UTC).
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Produtos afetados
FLIR Systems, Inc. · FLIR Thermal Camera PT-Series
PoCs públicas encontradas — 2
cve_referencewww.exploit-db.com/exploits/42785/não verificadocve_referencepacketstormsecurity.com/files/144321não verificado
⚠ Recursos públicos, para você avaliar a exposição de sistemas que controla ou está autorizado a testar. Teste apenas com autorização.

Quer saber se a sua infraestrutura está exposta a isto?

Falar com a TrueHacking →
Referências
https://cxsecurity.com/issue/WLB-2017090203https://packetstormsecurity.com/files/144321https://web.archive.org/web/20171011125811/https://www.flir.com/security/blog/details/?ID=87043https://www.exploit-db.com/exploits/42785/https://www.zeroscience.mk/en/vulnerabilities/ZSL-2017-5438.php