Description
FLIR Thermal Camera F/FC/PT/D firmware version 8.0.0.64 contains an information disclosure vulnerability that allows unauthenticated attackers to read arbitrary files through unverified input parameters. Attackers can exploit the /var/www/data/controllers/api/xml.php readFile() function to access local system files without authentication.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| FLIR Systems | FLIR Thermal Camera F/FC/PT/D | 8.0.0.64 | — |
References
- Zero Science Lab Vulnerability Advisory third-party-advisory
- Exploit Database Entry 42786 exploit
- Packet Storm Security Exploit Archive exploit
- CXSecurity Vulnerability Listing third-party-advisory
- Archived FLIR Security Advisory vendor-advisory patch