Critical · published January 7, 2026
🚨 This vulnerability lets attackers execute arbitrary commands remotely, like giving a hacker the keys to your security camera's control room! 🔥 Think of it as a restaurant where the chef takes orders without checking the menu — any dish can be served without a second thought. In this case, the vulnerable firmware allows attackers to send any command without authentication, creating a recipe for disaster. An attacker could take complete control of your FLIR Thermal Camera, executing any command as root. This means they could manipulate settings, access sensitive footage, or even disable the camera altogether, compromising your security in an absolutely devastating way.
Think of it as a restaurant where the chef takes orders without checking the menu — any dish can be served without a second thought. In this case, the vulnerable firmware allows attackers to send any command without authentication, creating a recipe for disaster. The CVE-2017-20216 vulnerability exists in the controllerFlirSystem.php script of the FLIR Thermal Camera PT-Series firmware version 8.0.0.64, allowing remote command injection through unsanitized POST parameters in the execFlirSystem() function. This results in unsafe calls to shell_exec(), letting attackers run arbitrary commands.
An attacker could take complete control of your FLIR Thermal Camera, executing any command as root. This means they could manipulate settings, access sensitive footage, or even disable the camera altogether, compromising your security in an absolutely devastating way. To protect yourself, immediately update the firmware to the latest version provided by FLIR. Additionally, implement strict input validation to sanitize all user inputs, and consider applying network-level access controls to restrict unauthenticated access. 🛡️ You've got this! By following these steps, you'll safeguard your system and keep the internet a safer place! ✨