FLIR AX8 Command Injection Vulnerability in Settings Regional Module

A critical command injection vulnerability has been identified in the FLIR AX8 camera, affecting versions through 1.46.16. The issue arises in the 'setDataTime' function within the 'settingsregional.php' file, where improper handling of the 'year', 'month', 'day', 'hour', and 'minute' parameters allows for remote command injection. This vulnerability has been publicly disclosed and is actively exploitable.

Impact

Exploitation of this vulnerability allows for remote command injection, where an attacker can execute arbitrary commands on the server where the FLIR AX8 is hosted.

Reproduction

The vulnerability can be reproduced by sending a request to the 'settingsregional.php' file with manipulated 'year', 'month', 'day', 'hour', and 'minute' parameters. This can be done remotely, and the exploitation appears to be straightforward.