CVE-2025-6266CWE-284CWE-434

Teledyne FLIR AX8 upload.php unrestricted upload

Medium · published June 19, 2025

CVSS v4.0
5.3
EPSS
1%
Percentile
42.2
In the wild
Unconfirmed
What it is

A vulnerability was detected in Teledyne FLIR AX8 up to 1.46. Affected by this vulnerability is an unknown functionality of the file /upload.php. Performing manipulation of the argument File results in unrestricted upload. It is possible to initiate the attack remotely. The exploit is now public and may be used. Upgrading to version 1.49.16 addresses this issue. Upgrading the affected component is recommended. The vendor points out: "FLIR AX8 internal web site has been refactored to be able to handle the reported vulnerabilities."

The record
Technical detail
CVSS v4.0
5.3 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
EPSS
0.00504 · 42.2th percentile
Weaknesses
CWE-284 · Improper Access Control; CWE-434 · Unrestricted Upload of File with Dangerous Type
Published
2025-06-19T12:00Z
EPSS history
Timeline
  • 19 JUN 12:00Z
    Teledyne FLIR AX8 upload.php unrestricted upload
    cvelistv5