Log in Start free

Vulnerability · Published Jun 5, 2025 · Assigned by VulDB

CVE-2025-5695Teledyne FLIR AX8 Backend subscriptions.php subscribe_to_alarm command injection

Medium 4.7

In plain English

A medium-severity command injection in AX8 from Teledyne FLIR. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 8.0% (higher than 95% of all known vulnerabilities).

Severity (CVSS 3.1)4.7Medium
Exploit odds (30 days)8.0%top 5.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

A vulnerability has been found in Teledyne FLIR AX8 up to 1.46.16. This impacts the function subscribe_to_spot/subscribe_to_delta/subscribe_to_alarm of the file /usr/www/application/models/subscriptions.php of the component Backend. Such manipulation leads to command injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 1.49.16 will fix this issue. It is suggested to upgrade the affected component. The vendor points out: "FLIR AX8 internal web site has been refactored to be able to handle the reported vulnerabilities."

Affected products (as reported)

VendorProductVersions
Teledyne FLIR AX8 1.46.01.46.11.46.21.46.31.46.41.46.51.46.61.46.7

Weakness: CWE-77, CWE-74 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C

References