var-202208-1429
Vulnerability from variot

All FLIR AX8 thermal sensor cameras version up to and including 1.46.16 are affected by an insecure design vulnerability due to an improper directory access restriction. An unauthenticated, remote attacker can exploit this by sending a URI that contains the path of the SQLite users database and download it. A successful exploit could allow the attacker to extract usernames and hashed passwords. FLIR Systems, Inc. of flir ax8 Firmware has a lack of authentication vulnerability for critical functionality.Information may be obtained. # FLIR AX8 vulnerabilities.

Product description:

The FLIR AX8 is a thermal sensor with imaging capabilities, combining thermal and visual cameras that provides continuous temperature monitoring and alarming for critical electrical and mechanical equipment.

Summary of the 4 vulnerabilities found / What we were able to find:

  • [CVE-2022-37061] - Unauthenticated OS Command Injection.

FLIR AX8 is affected by an unauthenticated remote command injection vulnerability. This can be exploited to inject and execute arbitrary shell commands as the root user through the id HTTP POST parameter in res.php endpoint.

  • [CVE-2022-37060] - Unauthenticated Directory Traversal.

  • [CVE-2022-37062] - Improper Access Control.

  • [CVE-2022-37063] - Reflected cross-site scripting.

FLIR AX8 is affected by a reflected cross-site scripting (XSS) vulnerability due to an improper input sanitization. An authenticated, remote attacker can execute arbitrary JavaScript code in the web management interface.

Step by Step Example (How to Reproduce and verify) the vulnerabilities:

  1. Unauthenticated Remote Command Injection.

The endpoint /res.php can be called remotely without user authentication as there is no cookie verification Cookie: PHPSESSID=ID to check if the request is legitimate. The second problem is that the POST parameter id can be injected to execute any Linux command. In the example below we create a crafted query that displays the contents of the /etc/shadow file.

The server returns a JSON response containing the contents of the /etc/shadow file. This command injection is due because there no sanitization check on the variable $_POST["id"], line 65, and can therefore take advantage of the shell_exec() function to execute unexpected arbitrary shell commands.

  1. Unauthenticated Directory Traversal.

The endpoint /download.php can be called remotely without user authentication as there is no cookie verification Cookie: PHPSESSID=ID to check if the request is legitimate. The second problem is that the GET parameter file can be injected with a relative file paths and download any files in the system. In the example below we create a crafted query that download the contents of the /etc/passwd file.

The error is due to the fact that there is no sanitization of the $file_path variable, line 26, when the fopen() function is called, line 39. However a comment in the code, line 24, and the use of the function pathinfo(), line 28, suggests that the developer thought about this problem and therefore created the variable $path_parts which is sanitized. But for some reasons the developer does not use the sanitizer variable $path_parts when the function fopen() is used. Probably an oversight.

  1. Improper Access Control.

The endpoint /FLIR/db/users.db can be called remotely without user authentication as there is no cookie verification Cookie: PHPSESSID=ID to check if the request is legitimate and let any malicious actor to download the users.db SQLite database.

  1. Reflected cross-site scripting.

In the settings tab, if a file with a filename that contains JavaScript code is selected via the update firmware file input the JavaScript code will be triggered and executed. In our example, we created a file call

.run

Recommendations for how to fix the 4 vulnerabilities:

  • Vulnerability 1: The variable $_POST["id"], line 65 in the file /FLIR/usr/www/res.php, must be sanitized using the function intval() and will remove any character other than integer value. escapeshellcmd() and escapeshellarg() must be also used to escapes any characters in a string that might be used to execute arbitrary commands.

More info: https://www.php.net/intval https://www.php.net/manual/en/function.escapeshellcmd https://www.php.net/manual/en/function.escapeshellarg

  • Vulnerability 2: The variable $file_path, line 39 in the file /FLIR/usr/www/download.php, must be sanitized using the function pathinfo() but also use a hard coded directory path, in case you need to manage several directories set a whitelist of all allowed directories and use multiple conditions.

More info: https://www.php.net/manual/en/function.pathinfo

  • Vulnerability 3: Define a whitelist of all directories that a user is allowed to access. This can be added to the Lighttpd server configuration file, in /etc/lighttpd.conf.

More info: https://www.cyberciti.biz/tips/howto-lighttpd-enable-disable-directory-listing.html

  • Vulnerability 4: To protect against filename XSS attack you can use a regex that will parse the filename to leave only numbers and letters.

More info: https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html

Reference:

https://www.flir.com/products/ax8-automation/

Security researchers:

  • [Thomas Knudsen] (https://www.linkedin.com/in/thomasjknudsen)
  • [Samy Younsi] (https://www.linkedin.com/in/samy-younsi)

Show details on source website

To clipboard 

{
  "@context": {
    "@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
    "affected_products": {
      "@id": "https://www.variotdbs.pl/ref/affected_products"
    },
    "credits": {
      "@id": "https://www.variotdbs.pl/ref/credits"
    },
    "cvss": {
      "@id": "https://www.variotdbs.pl/ref/cvss/"
    },
    "description": {
      "@id": "https://www.variotdbs.pl/ref/description/"
    },
    "exploit_availability": {
      "@id": "https://www.variotdbs.pl/ref/exploit_availability/"
    },
    "external_ids": {
      "@id": "https://www.variotdbs.pl/ref/external_ids/"
    },
    "iot": {
      "@id": "https://www.variotdbs.pl/ref/iot/"
    },
    "iot_taxonomy": {
      "@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
    },
    "patch": {
      "@id": "https://www.variotdbs.pl/ref/patch/"
    },
    "problemtype_data": {
      "@id": "https://www.variotdbs.pl/ref/problemtype_data/"
    },
    "references": {
      "@id": "https://www.variotdbs.pl/ref/references/"
    },
    "sources": {
      "@id": "https://www.variotdbs.pl/ref/sources/"
    },
    "sources_release_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_release_date/"
    },
    "sources_update_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_update_date/"
    },
    "threat_type": {
      "@id": "https://www.variotdbs.pl/ref/threat_type/"
    },
    "title": {
      "@id": "https://www.variotdbs.pl/ref/title/"
    },
    "type": {
      "@id": "https://www.variotdbs.pl/ref/type/"
    }
  },
  "@id": "https://www.variotdbs.pl/vuln/VAR-202208-1429",
  "affected_products": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/affected_products#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "model": "ax8",
        "scope": "lte",
        "trust": 1.0,
        "vendor": "flir",
        "version": "1.46.16"
      },
      {
        "model": "ax8",
        "scope": "eq",
        "trust": 0.8,
        "vendor": "flir",
        "version": null
      },
      {
        "model": "ax8",
        "scope": null,
        "trust": 0.8,
        "vendor": "flir",
        "version": null
      },
      {
        "model": "ax8",
        "scope": "lte",
        "trust": 0.8,
        "vendor": "flir",
        "version": "flir ax8  firmware  1.46.16  and earlier"
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2022-014924"
      },
      {
        "db": "NVD",
        "id": "CVE-2022-37062"
      }
    ]
  },
  "credits": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/credits#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Samy Younsi",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-202208-3377"
      }
    ],
    "trust": 0.6
  },
  "cve": "CVE-2022-37062",
  "cvss": {
    "@context": {
      "cvssV2": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
      },
      "cvssV3": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
      },
      "severity": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/cvss/severity#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/severity"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "cvssV2": [],
        "cvssV3": [
          {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "author": "nvd@nist.gov",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "exploitabilityScore": 3.9,
            "id": "CVE-2022-37062",
            "impactScore": 3.6,
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "trust": 1.0,
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          {
            "attackComplexity": "Low",
            "attackVector": "Network",
            "author": "NVD",
            "availabilityImpact": "None",
            "baseScore": 7.5,
            "baseSeverity": "High",
            "confidentialityImpact": "High",
            "exploitabilityScore": null,
            "id": "CVE-2022-37062",
            "impactScore": null,
            "integrityImpact": "None",
            "privilegesRequired": "None",
            "scope": "Unchanged",
            "trust": 0.8,
            "userInteraction": "None",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.0"
          }
        ],
        "severity": [
          {
            "author": "nvd@nist.gov",
            "id": "CVE-2022-37062",
            "trust": 1.0,
            "value": "HIGH"
          },
          {
            "author": "NVD",
            "id": "CVE-2022-37062",
            "trust": 0.8,
            "value": "High"
          },
          {
            "author": "CNNVD",
            "id": "CNNVD-202208-3377",
            "trust": 0.6,
            "value": "HIGH"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2022-014924"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202208-3377"
      },
      {
        "db": "NVD",
        "id": "CVE-2022-37062"
      }
    ]
  },
  "description": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/description#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "All FLIR AX8 thermal sensor cameras version up to and including 1.46.16 are affected by an insecure design vulnerability due to an improper directory access restriction. An unauthenticated, remote attacker can exploit this by sending a URI that contains the path of the SQLite users database and download it. A successful exploit could allow the attacker to extract usernames and hashed passwords. FLIR Systems, Inc. of flir ax8 Firmware has a lack of authentication vulnerability for critical functionality.Information may be obtained. # FLIR AX8 vulnerabilities. \n\n### Product description:\n\nThe FLIR AX8 is a thermal sensor with imaging capabilities, combining thermal and visual cameras that provides continuous temperature monitoring and alarming for critical electrical and mechanical equipment. \n\n\n### Summary of the 4 vulnerabilities found / What we were able to find:\n\n* [CVE-2022-37061] - Unauthenticated OS Command Injection. \n\nFLIR AX8 is affected by an unauthenticated remote command injection vulnerability. This can be exploited to inject and execute arbitrary shell commands as the root user through the `id` HTTP POST parameter in `res.php` endpoint. \n\n* [CVE-2022-37060] - Unauthenticated Directory Traversal. \n\n* [CVE-2022-37062] - Improper Access Control. \n\n* [CVE-2022-37063] - Reflected cross-site scripting. \n\nFLIR AX8 is affected by a reflected cross-site scripting (XSS) vulnerability due to an improper input sanitization. An authenticated, remote attacker can execute arbitrary JavaScript code in the web management interface. \n\n###  Step by Step Example (How to Reproduce and verify) the vulnerabilities:\n\n1. Unauthenticated Remote Command Injection. \n\nThe endpoint `/res.php` can be called remotely without user authentication as there is no cookie verification `Cookie: PHPSESSID=ID` to check if the request is legitimate. The second problem is that the POST parameter `id` can be injected to execute any Linux command. In the example below we create a crafted query that displays the contents of the `/etc/shadow` file. \n\nThe server returns a JSON response containing the contents of the `/etc/shadow` file.  This command injection is due because there no sanitization check on the variable `$_POST[\"id\"]`, line 65, and can therefore take advantage of the `shell_exec()` function to execute unexpected arbitrary shell commands. \n\n2. Unauthenticated Directory Traversal. \n\nThe endpoint `/download.php` can be called remotely without user authentication as there is no cookie verification `Cookie: PHPSESSID=ID` to check if the request is legitimate. The second problem is that the GET parameter `file` can be injected with a relative file paths and download any files in the system. In the example below we create a crafted query that download the contents of the `/etc/passwd` file. \n\nThe error is due to the fact that there is no sanitization of the `$file_path` variable, line 26, when the `fopen()` function is called, line 39. However a comment in the code, line 24, and the use of the function `pathinfo()`, line 28, suggests that the developer thought about this problem and therefore created the variable `$path_parts` which is sanitized. But for some reasons the developer does not use the sanitizer variable `$path_parts` when the function `fopen()` is used. Probably an oversight. \n\n3. Improper Access Control. \n\nThe endpoint `/FLIR/db/users.db` can be called remotely without user authentication as there is no cookie verification `Cookie: PHPSESSID=ID` to check if the request is legitimate and let any malicious actor to download the `users.db` SQLite database. \n\n4. Reflected cross-site scripting. \n\nIn the settings tab, if a file with a filename that contains JavaScript code is selected via the update firmware file input the JavaScript code will be triggered and executed. In our example, we created a file call \n\n\u003cimg src=x onerror=alert(String.fromCharCode(97,108,101,114,116,40,39,116,101,115,116,39,41,59));\u003e.run\n\n\n### Recommendations for how to fix the 4 vulnerabilities:\n\n* Vulnerability 1: The variable `$_POST[\"id\"]`, line 65 in the file `/FLIR/usr/www/res.php`, must be sanitized using the function `intval()` and will remove any character other than integer value. `escapeshellcmd()` and `escapeshellarg()` must be also used to escapes any characters in a string that might be used to execute arbitrary commands. \n\nMore info: \nhttps://www.php.net/intval\nhttps://www.php.net/manual/en/function.escapeshellcmd\nhttps://www.php.net/manual/en/function.escapeshellarg\n\n\n* Vulnerability 2: The variable `$file_path`, line 39 in the file `/FLIR/usr/www/download.php`, must be sanitized using the function `pathinfo()` but also use a hard coded directory path, in case you need to manage several directories set a whitelist of all allowed directories and use multiple conditions. \n\nMore info:\nhttps://www.php.net/manual/en/function.pathinfo\n\n* Vulnerability 3: Define a whitelist of all directories that a user is allowed to access. This can be added to the Lighttpd server configuration file, in `/etc/lighttpd.conf`. \n\nMore info:\nhttps://www.cyberciti.biz/tips/howto-lighttpd-enable-disable-directory-listing.html\n\n* Vulnerability 4: To protect against filename XSS attack you can use a regex that will parse the filename to leave only numbers and letters. \n\nMore info: \nhttps://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html\n\n### Reference:\nhttps://www.flir.com/products/ax8-automation/\n\n### Security researchers:\n* [Thomas Knudsen] (https://www.linkedin.com/in/thomasjknudsen)\n* [Samy Younsi] (https://www.linkedin.com/in/samy-younsi) \n\n\n\n",
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2022-37062"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2022-014924"
      },
      {
        "db": "PACKETSTORM",
        "id": "168116"
      }
    ],
    "trust": 1.71
  },
  "external_ids": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/external_ids#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "db": "NVD",
        "id": "CVE-2022-37062",
        "trust": 3.3
      },
      {
        "db": "PACKETSTORM",
        "id": "168116",
        "trust": 1.7
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2022-014924",
        "trust": 0.8
      },
      {
        "db": "CXSECURITY",
        "id": "WLB-2022080059",
        "trust": 0.6
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202208-3377",
        "trust": 0.6
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2022-014924"
      },
      {
        "db": "PACKETSTORM",
        "id": "168116"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202208-3377"
      },
      {
        "db": "NVD",
        "id": "CVE-2022-37062"
      }
    ]
  },
  "id": "VAR-202208-1429",
  "iot": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/iot#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": true,
    "sources": [
      {
        "db": "VARIoT devices database",
        "id": null
      }
    ],
    "trust": 1.0
  },
  "last_update_date": "2024-08-14T14:24:36.951000Z",
  "problemtype_data": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "problemtype": "CWE-306",
        "trust": 1.0
      },
      {
        "problemtype": "Lack of authentication for critical features (CWE-306) [NVD evaluation ]",
        "trust": 0.8
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2022-014924"
      },
      {
        "db": "NVD",
        "id": "CVE-2022-37062"
      }
    ]
  },
  "references": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/references#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "trust": 2.5,
        "url": "https://www.flir.com/products/ax8-automation/"
      },
      {
        "trust": 2.4,
        "url": "https://gist.github.com/nwqda/9e16852ab7827dc62b8e44d6180a6899"
      },
      {
        "trust": 2.2,
        "url": "http://packetstormsecurity.com/files/168116/flir-ax8-1.46.16-traversal-access-control-command-injection-xss.html"
      },
      {
        "trust": 0.9,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2022-37062"
      },
      {
        "trust": 0.6,
        "url": "https://cxsecurity.com/cveshow/cve-2022-37062/"
      },
      {
        "trust": 0.6,
        "url": "https://cxsecurity.com/issue/wlb-2022080059"
      },
      {
        "trust": 0.1,
        "url": "https://cheatsheetseries.owasp.org/cheatsheets/cross_site_scripting_prevention_cheat_sheet.html"
      },
      {
        "trust": 0.1,
        "url": "https://www.php.net/intval"
      },
      {
        "trust": 0.1,
        "url": "https://www.linkedin.com/in/thomasjknudsen)"
      },
      {
        "trust": 0.1,
        "url": "https://www.php.net/manual/en/function.pathinfo"
      },
      {
        "trust": 0.1,
        "url": "https://www.php.net/manual/en/function.escapeshellcmd"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2022-37060"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2022-37061"
      },
      {
        "trust": 0.1,
        "url": "https://www.linkedin.com/in/samy-younsi)"
      },
      {
        "trust": 0.1,
        "url": "https://www.cyberciti.biz/tips/howto-lighttpd-enable-disable-directory-listing.html"
      },
      {
        "trust": 0.1,
        "url": "https://www.php.net/manual/en/function.escapeshellarg"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2022-37063"
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2022-014924"
      },
      {
        "db": "PACKETSTORM",
        "id": "168116"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202208-3377"
      },
      {
        "db": "NVD",
        "id": "CVE-2022-37062"
      }
    ]
  },
  "sources": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2022-014924"
      },
      {
        "db": "PACKETSTORM",
        "id": "168116"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202208-3377"
      },
      {
        "db": "NVD",
        "id": "CVE-2022-37062"
      }
    ]
  },
  "sources_release_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2023-09-22T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2022-014924"
      },
      {
        "date": "2022-08-19T19:24:22",
        "db": "PACKETSTORM",
        "id": "168116"
      },
      {
        "date": "2022-08-18T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-202208-3377"
      },
      {
        "date": "2022-08-18T18:15:08.360000",
        "db": "NVD",
        "id": "CVE-2022-37062"
      }
    ]
  },
  "sources_update_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2023-09-22T08:25:00",
        "db": "JVNDB",
        "id": "JVNDB-2022-014924"
      },
      {
        "date": "2022-08-22T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-202208-3377"
      },
      {
        "date": "2022-10-26T17:01:56.470000",
        "db": "NVD",
        "id": "CVE-2022-37062"
      }
    ]
  },
  "threat_type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/threat_type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "remote",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-202208-3377"
      }
    ],
    "trust": 0.6
  },
  "title": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/title#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "FLIR\u00a0Systems,\u00a0Inc.\u00a0 of \u00a0flir\u00a0ax8\u00a0 Vulnerability related to lack of authentication for critical functions in firmware",
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2022-014924"
      }
    ],
    "trust": 0.8
  },
  "type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "access control error",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-202208-3377"
      }
    ],
    "trust": 0.6
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.