CVE-2025-5695CWE-74CWE-77

Teledyne FLIR AX8 Backend subscriptions.php subscribe_to_alarm command injection

Medium · published June 5, 2025

CVSS v4.0
5.1
EPSS
7%
Percentile
94.4
In the wild
Unconfirmed
What it is

A vulnerability has been found in Teledyne FLIR AX8 up to 1.46.16. This impacts the function subscribe_to_spot/subscribe_to_delta/subscribe_to_alarm of the file /usr/www/application/models/subscriptions.php of the component Backend. Such manipulation leads to command injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 1.49.16 will fix this issue. It is suggested to upgrade the affected component. The vendor points out: "FLIR AX8 internal web site has been refactored to be able to handle the reported vulnerabilities."

The record
Technical detail
CVSS v4.0
5.1 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
EPSS
0.07306 · 94.4th percentile
Weaknesses
CWE-74 · Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection'); CWE-77 · Improper Neutralization of Special Elements used in a Command ('Command Injection')
Published
2025-06-05T21:00Z
EPSS history
Timeline
  • 05 JUN 21:00Z
    Teledyne FLIR AX8 Backend subscriptions.php subscribe_to_alarm command injection
    cvelistv5