CVE-2024-3013

Teledyne FLIR AX8 User Registration test_login.php improper authorization

View on CVE.org
Published Mar 28, 2024 CVSS 4.0 · 5.3 Medium EPSS 23.0% KEV · Not listed
Description
A flaw has been found in Teledyne FLIR AX8 up to 1.46.16. The impacted element is an unknown function of the file /tools/test_login.php?action=register of the component User Registration. Executing manipulation can lead to improper authorization. The attack may be performed from remote. The exploit has been published and may be used. Upgrading to version 1.49.16 is sufficient to resolve this issue. Upgrading the affected component is recommended. The vendor points out: "FLIR AX8 internal web site has been refactored to be able to handle the reported vulnerabilities."

Remediation

No solution or workaround provided in the CVE record

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
EUVD EUVD EUVD-2024-31621 A vulnerability was found in FLIR AX8 up to 1.46.16. It has been rated as critical. This issue affects some unknown processing of the file /tools/test_login.php?action=register of the component User Registration. The manipulation leads to improper authorization. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-258299. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
History
Type Values Removed Values Added
CPEs cpe:2.3:o:flir:flir_ax8_firmware:1.46.0:*:*:*:*:*:*:*
cpe:2.3:o:flir:flir_ax8_firmware:1.46.10:*:*:*:*:*:*:*
cpe:2.3:o:flir:flir_ax8_firmware:1.46.11:*:*:*:*:*:*:*
cpe:2.3:o:flir:flir_ax8_firmware:1.46.12:*:*:*:*:*:*:*
cpe:2.3:o:flir:flir_ax8_firmware:1.46.13:*:*:*:*:*:*:*
cpe:2.3:o:flir:flir_ax8_firmware:1.46.14:*:*:*:*:*:*:*
cpe:2.3:o:flir:flir_ax8_firmware:1.46.15:*:*:*:*:*:*:*
cpe:2.3:o:flir:flir_ax8_firmware:1.46.16:*:*:*:*:*:*:*
cpe:2.3:o:flir:flir_ax8_firmware:1.46.1:*:*:*:*:*:*:*
cpe:2.3:o:flir:flir_ax8_firmware:1.46.2:*:*:*:*:*:*:*
cpe:2.3:o:flir:flir_ax8_firmware:1.46.3:*:*:*:*:*:*:*
cpe:2.3:o:flir:flir_ax8_firmware:1.46.4:*:*:*:*:*:*:*
cpe:2.3:o:flir:flir_ax8_firmware:1.46.5:*:*:*:*:*:*:*
cpe:2.3:o:flir:flir_ax8_firmware:1.46.6:*:*:*:*:*:*:*
cpe:2.3:o:flir:flir_ax8_firmware:1.46.7:*:*:*:*:*:*:*
cpe:2.3:o:flir:flir_ax8_firmware:1.46.8:*:*:*:*:*:*:*
cpe:2.3:o:flir:flir_ax8_firmware:1.46.9:*:*:*:*:*:*:*
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
Description A vulnerability was found in FLIR AX8 up to 1.46.16. It has been rated as critical. This issue affects some unknown processing of the file /tools/test_login.php?action=register of the component User Registration. The manipulation leads to improper authorization. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-258299. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. A flaw has been found in Teledyne FLIR AX8 up to 1.46.16. The impacted element is an unknown function of the file /tools/test_login.php?action=register of the component User Registration. Executing manipulation can lead to improper authorization. The attack may be performed from remote. The exploit has been published and may be used. Upgrading to version 1.49.16 is sufficient to resolve this issue. Upgrading the affected component is recommended. The vendor points out: "FLIR AX8 internal web site has been refactored to be able to handle the reported vulnerabilities."
Title FLIR AX8 User Registration improper authorization Teledyne FLIR AX8 User Registration test_login.php improper authorization
Weaknesses CWE-266
Metrics cvssV2_0

{'score': 6.5, 'vector': 'AV:N/AC:L/Au:S/C:P/I:P/A:P'}

cvssV3_0

{'score': 6.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L'}

cvssV3_1

{'score': 6.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L'}

 cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

cvssV2_0

{'score': 6.5, 'vector': 'AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:OF/RC:C'}

cvssV3_0

{'score': 6.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C'}

cvssV3_1

{'score': 6.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C'}
Type Values Removed Values Added
First Time appeared Flir
Flir flir Ax8
Flir flir Ax8 Firmware
CPEs cpe:2.3:h:flir:flir_ax8:-:*:*:*:*:*:*:*
cpe:2.3:o:flir:flir_ax8_firmware:*:*:*:*:*:*:*:*
Vendors & Products Flir
Flir flir Ax8
Flir flir Ax8 Firmware
Weaknesses

Sources

Status
PUBLISHED
Assigner
VulDB
Published
Updated
Oct 15, 2025, 1:18 PM
Reserved
Mar 27, 2024, 2:18 PM

View source JSON

Updated
Aug 1, 2024, 7:32 PM

JSON

Status
Modified
Published
Mar 28, 2024, 1:15 AM
Modified
Jun 17, 2026, 7:43 AM

View source JSON

No data.

No data.