CVE-2017-20215CWE-78

FLIR Thermal Camera FC-S/PT firmware version 8.0.0.64 Authenticated OS Command Injection

High · published January 7, 2026

CVSS v4.0
8.7
EPSS
16%
Percentile
96.9
In the wild
Unconfirmed
What it is

🚨 Attackers only need authenticated access to unleash chaos! An OS command injection vulnerability lurks in the FLIR Thermal Camera FC-S/PT firmware version 8.0.0.64, allowing complete control at the tap of a command. ⚡ Think of it like an overly trusting hotel concierge who hands out master keys to anyone who shows a guest badge — they can waltz into any room and do as they please, regardless of the consequences. This vulnerability lets authenticated users inject commands directly into the system, turning them into virtual overlords of the thermal camera. This vulnerability is like giving an intruder the keys to your security system! An attacker could use this flaw to run any command they want with root privileges, potentially compromising the entire thermal camera system, accessing sensitive data, or manipulating its operations. It's a security nightmare waiting to happen!

Put simply

Think of it like an overly trusting hotel concierge who hands out master keys to anyone who shows a guest badge — they can waltz into any room and do as they please, regardless of the consequences. This vulnerability lets authenticated users inject commands directly into the system, turning them into virtual overlords of the thermal camera. The vulnerability allows authenticated users to inject arbitrary shell commands through unvalidated input parameters, granting them root access to the system and the ability to execute any command.

What to do

This vulnerability is like giving an intruder the keys to your security system! An attacker could use this flaw to run any command they want with root privileges, potentially compromising the entire thermal camera system, accessing sensitive data, or manipulating its operations. It's a security nightmare waiting to happen! To remediate this, upgrade the firmware to a version that addresses this flaw. Ensure that all input parameters are properly validated to prevent command injection. Regularly review user access privileges and limit authenticated user permissions to minimize the impact of such vulnerabilities. You've got this! With these steps, you'll secure your thermal camera system in no time! 🛡️

The record
Technical detail
CVSS v4.0
8.7 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.15818 · 96.9th percentile
Weakness
CWE-78 · Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Published
2026-01-07T23:09Z
EPSS history
Timeline
  • 07 JAN 23:09Z
    FLIR Thermal Camera FC-S/PT firmware version 8.0.0.64 Authenticated OS Command Injection
    cvelistv5