CVE-2025-5126

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-5126
A vulnerability classified as critical was found in FLIR AX8 up to 1.46.16. This vulnerability affects the function setDataTime of the file \usr\www\application\models\settingsregional.php. The manipulation of the argument year/month/day/hour/minute leads to command injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS

No CVSS.

References
Link Resource
https://github.com/YZS17/CVE/blob/main/Remote%20Command%20Injection%20in%20parameter%20%24hour.md Exploit Third Party Advisory
https://github.com/YZS17/CVE/blob/main/Remote%20Command%20Injection%20in%20parameter%20%24minute.md Exploit Third Party Advisory
https://github.com/YZS17/CVE/blob/main/Remote%20Command%20Injection%20in%20parameter%20%24minute.md Exploit Third Party Advisory
https://vuldb.com/?ctiid.310204 Permissions Required VDB Entry
https://vuldb.com/?id.310204 Third Party Advisory VDB Entry
https://vuldb.com/?submit.570725 Third Party Advisory VDB Entry
Configurations

Configuration 1 (hide)

AND
cpe:2.3:o:flir:flir_ax8_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:flir:flir_ax8:-:*:*:*:*:*:*:*
History

16 Jun 2025, 18:05

Type Values Removed Values Added
CPE cpe:2.3:o:flir:flir_ax8_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:flir:flir_ax8:-:*:*:*:*:*:*:*
First Time Flir flir Ax8
Flir
Flir flir Ax8 Firmware
CWE CWE-77
References () https://github.com/YZS17/CVE/blob/main/Remote%20Command%20Injection%20in%20parameter%20%24hour.md - () https://github.com/YZS17/CVE/blob/main/Remote%20Command%20Injection%20in%20parameter%20%24hour.md - Exploit, Third Party Advisory
References () https://vuldb.com/?id.310204 - () https://vuldb.com/?id.310204 - Third Party Advisory, VDB Entry
References () https://vuldb.com/?ctiid.310204 - () https://vuldb.com/?ctiid.310204 - Permissions Required, VDB Entry
References () https://github.com/YZS17/CVE/blob/main/Remote%20Command%20Injection%20in%20parameter%20%24minute.md - () https://github.com/YZS17/CVE/blob/main/Remote%20Command%20Injection%20in%20parameter%20%24minute.md - Exploit, Third Party Advisory
References () https://vuldb.com/?submit.570725 - () https://vuldb.com/?submit.570725 - Third Party Advisory, VDB Entry

28 May 2025, 18:15

Type Values Removed Values Added
CWE CWE-77
CWE-74
CVSS v2 : unknown
v3 : 8.8 		v2 : unknown
v3 : unknown

24 May 2025, 15:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-05-24 15:15

Updated : 2025-06-16 18:05

NVD link : CVE-2025-5126

Mitre link : CVE-2025-5126

JSON object : View

Products Affected

flir

  • flir_ax8_firmware
  • flir_ax8
CWE
CWE-77

Improper Neutralization of Special Elements used in a Command ('Command Injection')