CVE-2022-4364
Published: 08 December 2022
Summary
CVE-2022-4364 is a medium-severity Injection (CWE-74) vulnerability in Flir Flir Ax8 Firmware. Its CVSS base score is 5.5 (Medium).
Operationally, ranked in the top 5.4% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
A command injection vulnerability exists in Teledyne FLIR AX8 devices up to firmware version 1.46.16. The flaw resides in an unknown function of the palette.php file within the Web Service Handler component, where unsanitized input to the palette argument is passed to system commands, corresponding to CWE-74, CWE-77, and CWE-78.
Remote unauthenticated attackers can supply crafted palette values over the network to execute arbitrary commands on the device, achieving limited impacts to confidentiality, integrity, and availability as reflected in the CVSS 5.5 rating. Public exploit code has been released demonstrating the issue.
Vendor guidance states that upgrading to version 1.49.16 resolves the vulnerability through a full refactor of the internal web site to address the reported injection flaws.
The associated EPSS score has remained flat at 0.1462 with no material increase after disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-51714
Vulnerability details
A vulnerability has been found in Teledyne FLIR AX8 up to 1.46.16. Affected by this issue is some unknown functionality of the file palette.php of the component Web Service Handler. The manipulation of the argument palette leads to command injection.…
more
The attack is possible to be carried out remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 1.49.16 can resolve this issue. Upgrading the affected component is advised. The vendor points out: "FLIR AX8 internal web site has been refactored to be able to handle the reported vulnerabilities."
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Developer assessments and testing (including injection-focused techniques) identify improper neutralization of special elements, and the verifiable flaw remediation corrects them pre-deployment.
Platform-independent apps typically execute inside a managed runtime or sandbox that restricts direct OS command execution, reducing the ability to exploit OS command injection.
Validates inputs to block special elements that would alter OS command execution.
Identifies indicators of injection attacks (command, SQL, LDAP, etc.) via anomaly and attack monitoring.