FLIR AX8 Command Injection Vulnerability in Backend Subscription Management

A critical command injection vulnerability has been identified in the FLIR AX8 camera, affecting versions through 1.46.16. The issue resides in the backend component, specifically within the file '/usr/www/application/models/subscriptions.php'. The vulnerability arises in the 'subscribe_to_spot', 'subscribe_to_delta', and 'subscribe_to_alarm' functions, where the application improperly sanitizes user input, allowing remote attackers to execute arbitrary commands on the server.

Impact

Exploitation of this vulnerability allows for arbitrary command execution on the affected device.

Reproduction

The vulnerability can be reproduced by sending a request to the 'subscribe_to_spot', 'subscribe_to_delta', or 'subscribe_to_alarm' functions in the 'subscriptions.php' model. This can be done after authenticating successfully on the device.

Remediation

Users are advised to upgrade to FLIR AX8 version 1.55.16, available for download from the FLIR Customer Support website.