Teledyne FLIR FB-Series O and FH-Series Command Injection Vulnerability

A command injection vulnerability has been identified in Teledyne FLIR FB-Series O and FLIR FH-Series ID version 1.3.2.16. The issue arises in the 'sendCommand' function of the 'runcmd.sh' file, where the 'cmd' argument can be manipulated to inject commands. This vulnerability can be exploited remotely, although the exploitation process is considered complex and difficult. Currently, the vulnerable functionality is disabled due to server CGI configuration errors, but it remains a potential risk.

Impact

Exploitation of this vulnerability allows for arbitrary command execution on the affected device.