FLIR Systems vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Latest high and critical flaws

• CVE-2017-20216 FLIR Thermal Camera PT-Series firmware version 8.0.0.64 contains multiple unauthenticated remote command injection vulnerabilities in the controllerFlirSystem.pCritical 9.3 · Jan 7, 2026
• CVE-2017-20215 FLIR Thermal Camera FC-S/PT firmware version 8.0.0.64 contains an authenticated OS command injection vulnerability that allows attackers to execute shell commanHigh 8.7 · Jan 7, 2026
• CVE-2017-20214 FLIR Thermal Camera F/FC/PT/D firmware version 8.0.0.64 contains hard-coded SSH credentials that cannot be changed through normal camera operations.Critical 9.3 · Jan 7, 2026
• CVE-2017-20213 FLIR Thermal Camera F/FC/PT/D Stream firmware version 8.0.0.64 contains an unauthenticated vulnerability that allows remote attackers to access live camera streHigh 8.7 · Jan 7, 2026
• CVE-2017-20212 FLIR Thermal Camera F/FC/PT/D firmware version 8.0.0.64 contains an information disclosure vulnerability that allows unauthenticated attackers to read arbitraryHigh 8.7 · Jan 7, 2026
• CVE-2018-25141 FLIR thermal traffic cameras contain an unauthenticated vulnerability that allows remote attackers to access live video streams without credentials.High 8.7 · Dec 24, 2025
• CVE-2018-25140 FLIR thermal traffic cameras contain an unauthenticated device manipulation vulnerability in their WebSocket implementation that allows attackers to bypass authCritical 9.3 · Dec 24, 2025
• CVE-2018-25139 FLIR AX8 Thermal Camera 1.32.16 contains an unauthenticated vulnerability that allows remote attackers to access live video streams without credentials.High 8.7 · Dec 24, 2025
• CVE-2018-25138 FLIR AX8 Thermal Camera 1.32.16 contains hard-coded SSH and web panel credentials that cannot be changed through normal camera operations.Critical 9.3 · Dec 24, 2025
• CVE-2018-25137 FLIR Brickstream 3D+ 2.1.742.1842 contains an unauthenticated vulnerability in the ExportConfig REST API that allows attackers to download sensitive configuratiHigh 8.7 · Dec 24, 2025
• CVE-2018-25136 FLIR Brickstream 3D+ 2.1.742.1842 contains an unauthenticated vulnerability that allows remote attackers to access live video streams without credentials.High 8.7 · Dec 24, 2025
• CVE-2023-51127 FLIR AX8 thermal sensor cameras up to and including 1.46.16 are vulnerable to Directory Traversal due to improper access restriction.High 7.5 · Jan 10, 2024
• CVE-2023-51126 Command injection vulnerability in /usr/www/res.php in FLIR AX8 up to 1.46.16 allows attackers to run arbitrary commands via the value parameter.Critical 9.8 · Jan 10, 2024
• CVE-2023-29861 An issue found in FLIR-DVTEL version not specified allows a remote attacker to execute arbitrary code via a crafted request to the management page of the deviceCritical 9.8 · May 15, 2023
• CVE-2022-37062 All FLIR AX8 thermal sensor cameras version up to and including 1.46.16 are affected by an insecure design vulnerability due to an improper directory access resHigh 7.5 · Aug 18, 2022
• CVE-2022-37061 All FLIR AX8 thermal sensor cameras version up to and including 1.46.16 are vulnerable to Remote Command Injection.Critical 9.8 · Aug 18, 2022
• CVE-2022-37060 FLIR AX8 thermal sensor cameras version up to and including 1.46.16 is vulnerable to Directory Traversal due to an improper access restriction.High 7.5 · Aug 18, 2022
• CVE-2018-12920 Brickstream 2300 devices allow remote attackers to obtain potentially sensitive information via a direct request for the basic.html#ipsettings or basic.html#datHigh 7.5 · Jun 28, 2018
• CVE-2018-3813 getConfigExportFile.cgi on FLIR Brickstream 2300 devices 2.0 4.1.53.166 has Incorrect Access Control, as demonstrated by reading the AVI_USER_ID and AVI_USER_PACritical 9.8 · Jan 1, 2018