CVE-2023-51127
Published: 10 January 2024
Summary
CVE-2023-51127 is a high-severity Path Traversal (CWE-22) vulnerability in Flir Flir Ax8 Firmware. Its CVSS base score is 7.5 (High).
Operationally, ranked in the top 9.8% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
FLIR AX8 thermal sensor cameras up to and including firmware version 1.46.16 contain a directory traversal vulnerability resulting from improper access restrictions and tracked as CWE-22. The flaw resides in the camera's web interface or file-handling functionality and carries a CVSS 3.1 score of 7.5 reflecting high confidentiality impact with network attack vector and no required credentials or user interaction.
An unauthenticated remote attacker can exploit the issue by uploading a specially crafted symbolic link file, enabling retrieval of arbitrary sensitive file contents from the device without authentication.
The vendor states that firmware version 1.49.16 released in January 2023 resolves the vulnerability, and the current latest release is 1.55.16 from June 2024. Public references consist of proof-of-concept repositories demonstrating the symbolic-link upload technique.
The EPSS score has remained flat at 0.0524 with no material increase after disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-55849
Vulnerability details
FLIR AX8 thermal sensor cameras up to and including 1.46.16 are vulnerable to Directory Traversal due to improper access restriction. This vulnerability allows an unauthenticated, remote attacker to obtain arbitrary sensitive file contents by uploading a specially crafted symbolic link…
more
file. NOTE: The vendor has stated that with the introduction of firmware version 1.49.16 (Jan 2023) the FLIR AX8 should no longer be affected by the vulnerability reported. Latest firmware version (as of Oct 2025, was released Jun 2024) is 1.55.16.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Validates pathnames and filenames to prevent traversal outside intended directories.