Vulnerability record · CVE-2022-37061 · published 18 August 2022
CVE-2022-37061: FLIR AX8 thermal cameras unauthenticated OS command injection
Flir · Flir Ax8 Firmware
FLIR AX8 thermal sensor cameras up to firmware 1.46.16 pass the id HTTP POST parameter in res.php to a shell without sanitisation, allowing OS command injection. Because the injected commands run as root, a single unauthenticated request can fully compromise the device. Firmware 1.49.16 (Jan 2023) and later are reported by the vendor to fix the issue.
Description
All FLIR AX8 thermal sensor cameras version up to and including 1.46.16 are vulnerable to Remote Command Injection. This can be exploited to inject and execute arbitrary shell commands as the root user through the id HTTP POST parameter in the res.php endpoint. A successful exploit could allow the attacker to execute arbitrary commands on the underlying operating system with the root privileges. NOTE: The vendor has stated that with the introduction of firmware version 1.49.16 (Jan 2023) the FLIR AX8 should no longer be affected by the vulnerability reported. Latest firmware version (as of Oct 2025, was released Jun 2024) is 1.55.16.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Automated analysis
critical priorityUnauthenticated network-reachable root command injection with public exploit code and near-maximum EPSS probability.
What it is
FLIR AX8 thermal sensor cameras up to firmware 1.46.16 pass the id HTTP POST parameter in res.php to a shell without sanitisation, allowing OS command injection. Because the injected commands run as root, a single unauthenticated request can fully compromise the device. Firmware 1.49.16 (Jan 2023) and later are reported by the vendor to fix the issue.
Impact
An attacker gains arbitrary command execution as root on the camera, giving full control of the device and any data or network access it holds.
Attack surface
Reachable over the network via HTTP POST to the res.php endpoint; the CVSS vector (AV:N/PR:N/UI:N) and the description indicate no authentication or user interaction is required.
Exploitation
Public exploit code and write-ups are referenced (Packet Storm, Zero Science, GitHub PoC), and EPSS is 0.99607 (99.9th percentile), indicating very high likelihood of exploitation; the CVE is not listed in CISA KEV.
What to do
- Upgrade FLIR AX8 firmware to 1.49.16 or later (latest is 1.55.16, Jun 2024) as the vendor states the flaw is fixed from 1.49.16.
- If patching is not possible, isolate affected cameras on a dedicated VLAN with no internet access and restrict HTTP access to trusted management hosts.
- Block or filter POST requests to res.php at the network boundary where feasible.
- Replace end-of-support units that cannot be upgraded to a fixed firmware.
- Monitor vendor advisories for further firmware updates beyond 1.55.16.
Detection
- Inspect HTTP POST bodies to res.php for shell metacharacters or unexpected commands in the id parameter.
- Alert on outbound connections or processes spawned by the camera that are inconsistent with normal operation.
- Review camera logs and network flows for anomalous requests to res.php from untrusted sources.
- Baseline normal camera HTTP traffic and flag deviations in request volume or payload structure.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2022-37061 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2022-37061), CISA KEV, FIRST EPSS (scores of 2026-09-24). This page is refreshed as NVD updates the record.
