Teledyne FLIR AX8 Backend subscriptions.php subscribe_to_alarm command injection
Vulnerability Description
A vulnerability has been found in Teledyne FLIR AX8 up to 1.46.16. This impacts the function subscribe_to_spot/subscribe_to_delta/subscribe_to_alarm of the file /usr/www/application/models/subscriptions.php of the component Backend. Such manipulation leads to command injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 1.49.16 will fix this issue. It is suggested to upgrade the affected component. The vendor points out: "FLIR AX8 internal web site has been refactored to be able to handle the reported vulnerabilities."
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-5695
Credits & Attribution
The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:
- XU17 (VulDB User)
References
- https://vuldb.com/?id.311211
- https://vuldb.com/?ctiid.311211
- https://vuldb.com/?submit.585715
- https://vuldb.com/?submit.584532
- https://vuldb.com/?submit.585716
- https://github.com/YZS17/CVE/blob/main/Command%20injection%20vulnerability%20in%20subscribe_to_spot()%20in%20FLIR%20AX8.md
- https://github.com/YZS17/CVE/blob/main/Command%20injection%20vulnerability%20in%20subscribe_to_delta()%20in%20FLIR%20AX8.md
- https://flir.custhelp.com/app/account/fl_download_software
More from Teledyne FLIR
View All →Affected Vendor
Teledyne FLIR
View all reports →