FLIR AX8 Thermal Camera Hard-Coded Credentials Vulnerability Allowing Unauthorized Access

A vulnerability exists in the FLIR AX8 Thermal Camera running firmware 1.32.16, due to hard-coded SSH and web panel credentials that cannot be changed through normal camera operations. These persistent credentials can be exploited by attackers to gain unauthorized shell access or to log into various camera interfaces using default username and password combinations.

Impact

Exploitation of this vulnerability allows for unauthorized shell access on the camera, as well as access to the camera's web interface using default credentials. According to FLIR, this vulnerability could also lead to a denial-of-service.