CVE-2018-25140CWE-306

FLIR Thermal Traffic Cameras V1.01-0bb5b27 Unauthenticated Websocket Device Manipulation

Critical · published December 24, 2025

CVSS v4.0
9.3
EPSS
0%
Percentile
24.3
In the wild
Unconfirmed
What it is

🚨 A crafty attacker can bypass all security layers on FLIR thermal traffic cameras without breaking a sweat! 🔥 Think of this vulnerability like a sneaky hacker who can stroll right into a secure control room without showing ID and start tampering with the monitors — an absolute security nightmare! If exploited, an attacker could directly modify critical device configurations, access sensitive system information, or even initiate a denial of service. This could lead to compromised surveillance capabilities, leaving key areas vulnerable and exposed.

Put simply

Think of this vulnerability like a sneaky hacker who can stroll right into a secure control room without showing ID and start tampering with the monitors — an absolute security nightmare! This vulnerability in the WebSocket implementation allows unauthenticated attackers to manipulate device settings and access unauthorized system data, bypassing authentication and authorization controls entirely.

What to do

If exploited, an attacker could directly modify critical device configurations, access sensitive system information, or even initiate a denial of service. This could lead to compromised surveillance capabilities, leaving key areas vulnerable and exposed. To mitigate this issue, ensure that all affected FLIR thermal traffic cameras are updated to the latest firmware version that fixes this vulnerability. Additionally, implement strict network controls and monitor WebSocket connections for any suspicious activity. You've got this! Follow these steps to secure your cameras and keep your systems safe! 🛡️

The record
Technical detail
CVSS v4.0
9.3 · CRITICAL
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00325 · 24.3th percentile
Weakness
CWE-306 · Missing Authentication for Critical Function
Published
2025-12-24T19:27Z
EPSS history
Timeline
  • 24 DEC 19:27Z
    FLIR Thermal Traffic Cameras V1.01-0bb5b27 Unauthenticated Websocket Device Manipulation
    cvelistv5