CVE-2022-37061Not scoredCWE-78

CVE-2022-37061: FLIR AX8 1.46.16 - Remote Command Injection

Flir · Flir Ax8 Firmware

Affected: Flir Ax8 Firmware · Exploitation: check available, not yet exploited

Not in CyberSIXT coverage yet: no article names this CVE. This page shows the public record.

99.6%probability of exploitation in the next 30 days

99th percentile

050100

Higher than 99% of scored CVEs

Not scored yet. The CVE record carries no CVSS score.

DescriptionCVE.org

All FLIR AX8 thermal sensor cameras version up to and including 1.46.16 are vulnerable to Remote Command Injection. This can be exploited to inject and execute arbitrary shell commands as the root user through the id HTTP POST parameter in the res.php endpoint. A successful exploit could allow the attacker to execute arbitrary commands on the underlying operating system with the root privileges. NOTE: The vendor has stated that with the introduction of firmware version 1.49.16 (Jan 2023) the FLIR AX8 should no longer be affected by the vulnerability reported. Latest firmware version (as of Oct 2025, was released Jun 2024) is 1.55.16.

On the Atlas

Every published CVE is on the CyberSIXT Atlas, grouped by weakness, vendor and month.

Open the Atlas

Exploitation: Check available, not yet exploited. A public nuclei template can confirm it on a system you are authorised to test.
CISA KEV: Not listed
Public check: FLIR AX8 1.46.16 - Remote Command Injection · nuclei template in projectdiscovery/nuclei-templates
Weakness: OS Command Injection · Command and Code Injection
Vendor: Flir
Published: August 2022
Band: Check available, not yet exploited, August 2022

CoverageNo articles yet

No CyberSIXT article names CVE-2022-37061 yet, so there is no coverage timeline, action brief or change log for it. Everything on this page comes from the public CVE record, CISA KEV, EPSS and the nuclei template index. Search the archive or see the CVEs in the news.