Vulnerability-Lookup

VAR-202403-1099

Vulnerability from variot - Updated: 2025-10-15 23:43

A flaw has been found in Teledyne FLIR AX8 up to 1.46.16. The impacted element is an unknown function of the file /tools/test_login.php?action=register of the component User Registration. Executing manipulation can lead to improper authorization. The attack may be performed from remote. The exploit has been published and may be used. Upgrading to version 1.49.16 is sufficient to resolve this issue. Upgrading the affected component is recommended. The vendor points out: "FLIR AX8 internal web site has been refactored to be able to handle the reported vulnerabilities.". FLIR Systems, Inc. of flir ax8 The firmware contains an authorization vulnerability.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state

Show details on source website

JSON

To clipboard

{
  "@context": {
    "@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
    "affected_products": {
      "@id": "https://www.variotdbs.pl/ref/affected_products"
    },
    "configurations": {
      "@id": "https://www.variotdbs.pl/ref/configurations"
    },
    "credits": {
      "@id": "https://www.variotdbs.pl/ref/credits"
    },
    "cvss": {
      "@id": "https://www.variotdbs.pl/ref/cvss/"
    },
    "description": {
      "@id": "https://www.variotdbs.pl/ref/description/"
    },
    "exploit_availability": {
      "@id": "https://www.variotdbs.pl/ref/exploit_availability/"
    },
    "external_ids": {
      "@id": "https://www.variotdbs.pl/ref/external_ids/"
    },
    "iot": {
      "@id": "https://www.variotdbs.pl/ref/iot/"
    },
    "iot_taxonomy": {
      "@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
    },
    "patch": {
      "@id": "https://www.variotdbs.pl/ref/patch/"
    },
    "problemtype_data": {
      "@id": "https://www.variotdbs.pl/ref/problemtype_data/"
    },
    "references": {
      "@id": "https://www.variotdbs.pl/ref/references/"
    },
    "sources": {
      "@id": "https://www.variotdbs.pl/ref/sources/"
    },
    "sources_release_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_release_date/"
    },
    "sources_update_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_update_date/"
    },
    "threat_type": {
      "@id": "https://www.variotdbs.pl/ref/threat_type/"
    },
    "title": {
      "@id": "https://www.variotdbs.pl/ref/title/"
    },
    "type": {
      "@id": "https://www.variotdbs.pl/ref/type/"
    }
  },
  "@id": "https://www.variotdbs.pl/vuln/VAR-202403-1099",
  "affected_products": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/affected_products#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "model": "ax8",
        "scope": "lte",
        "trust": 1.0,
        "vendor": "flir",
        "version": "1.46.16"
      },
      {
        "model": "ax8",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "flir",
        "version": "1.46.0"
      },
      {
        "model": "ax8",
        "scope": "eq",
        "trust": 0.8,
        "vendor": "flir",
        "version": "flir ax8  firmware  1.46.0  to  1.46.16"
      },
      {
        "model": "ax8",
        "scope": null,
        "trust": 0.8,
        "vendor": "flir",
        "version": null
      },
      {
        "model": "ax8",
        "scope": "eq",
        "trust": 0.8,
        "vendor": "flir",
        "version": null
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2024-025053"
      },
      {
        "db": "NVD",
        "id": "CVE-2024-3013"
      }
    ]
  },
  "cve": "CVE-2024-3013",
  "cvss": {
    "@context": {
      "cvssV2": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
      },
      "cvssV3": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
      },
      "severity": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/cvss/severity#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/severity"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "cvssV2": [
          {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "SINGLE",
            "author": "cna@vuldb.com",
            "availabilityImpact": "PARTIAL",
            "baseScore": 6.5,
            "confidentialityImpact": "PARTIAL",
            "exploitabilityScore": 8.0,
            "id": "CVE-2024-3013",
            "impactScore": 6.4,
            "integrityImpact": "PARTIAL",
            "severity": "MEDIUM",
            "trust": 1.0,
            "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P",
            "version": "2.0"
          },
          {
            "acInsufInfo": null,
            "accessComplexity": "Low",
            "accessVector": "Network",
            "authentication": "Single",
            "author": "OTHER",
            "availabilityImpact": "Partial",
            "baseScore": 6.5,
            "confidentialityImpact": "Partial",
            "exploitabilityScore": null,
            "id": "JVNDB-2024-025053",
            "impactScore": null,
            "integrityImpact": "Partial",
            "obtainAllPrivilege": null,
            "obtainOtherPrivilege": null,
            "obtainUserPrivilege": null,
            "severity": "Medium",
            "trust": 0.8,
            "userInteractionRequired": null,
            "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P",
            "version": "2.0"
          }
        ],
        "cvssV3": [
          {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "author": "cna@vuldb.com",
            "availabilityImpact": "LOW",
            "baseScore": 6.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "exploitabilityScore": 2.8,
            "id": "CVE-2024-3013",
            "impactScore": 3.4,
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "trust": 1.0,
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
            "version": "3.1"
          },
          {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "author": "nvd@nist.gov",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "exploitabilityScore": 2.8,
            "id": "CVE-2024-3013",
            "impactScore": 5.9,
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "trust": 1.0,
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          {
            "attackComplexity": "Low",
            "attackVector": "Network",
            "author": "NVD",
            "availabilityImpact": "High",
            "baseScore": 8.8,
            "baseSeverity": "High",
            "confidentialityImpact": "High",
            "exploitabilityScore": null,
            "id": "JVNDB-2024-025053",
            "impactScore": null,
            "integrityImpact": "High",
            "privilegesRequired": "Low",
            "scope": "Unchanged",
            "trust": 0.8,
            "userInteraction": "None",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.0"
          }
        ],
        "severity": [
          {
            "author": "cna@vuldb.com",
            "id": "CVE-2024-3013",
            "trust": 1.0,
            "value": "Low"
          },
          {
            "author": "nvd@nist.gov",
            "id": "CVE-2024-3013",
            "trust": 1.0,
            "value": "HIGH"
          },
          {
            "author": "OTHER",
            "id": "JVNDB-2024-025053",
            "trust": 0.8,
            "value": "High"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2024-025053"
      },
      {
        "db": "NVD",
        "id": "CVE-2024-3013"
      },
      {
        "db": "NVD",
        "id": "CVE-2024-3013"
      }
    ]
  },
  "description": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/description#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "A flaw has been found in Teledyne FLIR AX8 up to 1.46.16. The impacted element is an unknown function of the file /tools/test_login.php?action=register of the component User Registration. Executing manipulation can lead to improper authorization. The attack may be performed from remote. The exploit has been published and may be used. Upgrading to version 1.49.16 is sufficient to resolve this issue. Upgrading the affected component is recommended. The vendor points out: \"FLIR AX8 internal web site has been refactored to be able to handle the reported vulnerabilities.\". FLIR Systems, Inc. of flir ax8 The firmware contains an authorization vulnerability.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state",
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2024-3013"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2024-025053"
      }
    ],
    "trust": 1.62
  },
  "external_ids": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/external_ids#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "db": "NVD",
        "id": "CVE-2024-3013",
        "trust": 2.6
      },
      {
        "db": "VULDB",
        "id": "258299",
        "trust": 1.8
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2024-025053",
        "trust": 0.8
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2024-025053"
      },
      {
        "db": "NVD",
        "id": "CVE-2024-3013"
      }
    ]
  },
  "id": "VAR-202403-1099",
  "iot": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/iot#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": true,
    "sources": [
      {
        "db": "VARIoT devices database",
        "id": null
      }
    ],
    "trust": 1.0
  },
  "last_update_date": "2025-10-15T23:43:35.244000Z",
  "problemtype_data": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "problemtype": "CWE-266",
        "trust": 1.0
      },
      {
        "problemtype": "CWE-285",
        "trust": 1.0
      },
      {
        "problemtype": "Inappropriate authorization (CWE-285) [ others ]",
        "trust": 0.8
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2024-025053"
      },
      {
        "db": "NVD",
        "id": "CVE-2024-3013"
      }
    ]
  },
  "references": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/references#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "trust": 1.8,
        "url": "https://vuldb.com/?id.258299"
      },
      {
        "trust": 1.8,
        "url": "https://vuldb.com/?submit.301588"
      },
      {
        "trust": 1.0,
        "url": "https://h0e4a0r1t.github.io/2024/vulns/flir-ax8%20fixed%20thermal%20cameras%20register%20any%20user%20in%20the%20background--test_login.php.pdf"
      },
      {
        "trust": 1.0,
        "url": "https://vuldb.com/?ctiid.258299"
      },
      {
        "trust": 0.8,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2024-3013"
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2024-025053"
      },
      {
        "db": "NVD",
        "id": "CVE-2024-3013"
      }
    ]
  },
  "sources": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2024-025053"
      },
      {
        "db": "NVD",
        "id": "CVE-2024-3013"
      }
    ]
  },
  "sources_release_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2025-06-16T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2024-025053"
      },
      {
        "date": "2024-03-28T01:15:47.997000",
        "db": "NVD",
        "id": "CVE-2024-3013"
      }
    ]
  },
  "sources_update_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2025-06-16T01:08:00",
        "db": "JVNDB",
        "id": "JVNDB-2024-025053"
      },
      {
        "date": "2025-10-15T14:15:38.300000",
        "db": "NVD",
        "id": "CVE-2024-3013"
      }
    ]
  },
  "title": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/title#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "FLIR\u00a0Systems,\u00a0Inc.\u00a0 of \u00a0flir\u00a0ax8\u00a0 Firmware authorization vulnerability",
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2024-025053"
      }
    ],
    "trust": 0.8
  }
}

CVE-2024-3013 (GCVE-0-2024-3013)

Vulnerability from cvelistv5 – Published: 2024-03-28 00:31 – Updated: 2025-10-15 13:18

Title

Teledyne FLIR AX8 User Registration test_login.php improper authorization

Summary

Severity ?

5.3 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P

6.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C

6.3 (Medium)


                        
                          CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C

CWE

CWE-285 - Improper Authorization
CWE-266 - Incorrect Privilege Assignment

Assigner

VulDB

References

URL

Tags

	https://vuldb.com/?id.258299	vdb-entrytechnical-description
	https://vuldb.com/?ctiid.258299	signaturepermissions-required
	https://vuldb.com/?submit.301588	third-party-advisory
	https://h0e4a0r1t.github.io/2024/vulns/FLIR-AX8%2…	broken-linkexploit

Impacted products

	Vendor	Product	Version
	Teledyne FLIR	AX8	Affected: 1.46.0 Affected: 1.46.1 Affected: 1.46.2 Affected: 1.46.3 Affected: 1.46.4 Affected: 1.46.5 Affected: 1.46.6 Affected: 1.46.7 Affected: 1.46.8 Affected: 1.46.9 Affected: 1.46.10 Affected: 1.46.11 Affected: 1.46.12 Affected: 1.46.13 Affected: 1.46.14 Affected: 1.46.15 Affected: 1.46.16 Unaffected: 1.49.16

Credits

H0e4a0r1t (VulDB User)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-01T19:32:42.489Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "VDB-258299 | FLIR AX8 User Registration improper authorization",
            "tags": [
              "vdb-entry",
              "x_transferred"
            ],
            "url": "https://vuldb.com/?id.258299"
          },
          {
            "name": "VDB-258299 | CTI Indicators (IOB, IOC, TTP, IOA)",
            "tags": [
              "signature",
              "permissions-required",
              "x_transferred"
            ],
            "url": "https://vuldb.com/?ctiid.258299"
          },
          {
            "name": "Submit #301588 | FLIR FLIR-AX8 Fixed Thermal Cameras 1.46.16 and below Register any user in the background",
            "tags": [
              "third-party-advisory",
              "x_transferred"
            ],
            "url": "https://vuldb.com/?submit.301588"
          },
          {
            "tags": [
              "exploit",
              "x_transferred"
            ],
            "url": "https://h0e4a0r1t.github.io/2024/vulns/FLIR-AX8%20Fixed%20Thermal%20Cameras%20Register%20any%20user%20in%20the%20background--test_login.php.pdf"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:o:flir:flir_ax8_firmware:1.46.0:*:*:*:*:*:*:*",
              "cpe:2.3:o:flir:flir_ax8_firmware:1.46.1:*:*:*:*:*:*:*",
              "cpe:2.3:o:flir:flir_ax8_firmware:1.46.10:*:*:*:*:*:*:*",
              "cpe:2.3:o:flir:flir_ax8_firmware:1.46.11:*:*:*:*:*:*:*",
              "cpe:2.3:o:flir:flir_ax8_firmware:1.46.12:*:*:*:*:*:*:*",
              "cpe:2.3:o:flir:flir_ax8_firmware:1.46.13:*:*:*:*:*:*:*",
              "cpe:2.3:o:flir:flir_ax8_firmware:1.46.14:*:*:*:*:*:*:*",
              "cpe:2.3:o:flir:flir_ax8_firmware:1.46.15:*:*:*:*:*:*:*",
              "cpe:2.3:o:flir:flir_ax8_firmware:1.46.16:*:*:*:*:*:*:*",
              "cpe:2.3:o:flir:flir_ax8_firmware:1.46.2:*:*:*:*:*:*:*",
              "cpe:2.3:o:flir:flir_ax8_firmware:1.46.3:*:*:*:*:*:*:*",
              "cpe:2.3:o:flir:flir_ax8_firmware:1.46.4:*:*:*:*:*:*:*",
              "cpe:2.3:o:flir:flir_ax8_firmware:1.46.5:*:*:*:*:*:*:*",
              "cpe:2.3:o:flir:flir_ax8_firmware:1.46.6:*:*:*:*:*:*:*",
              "cpe:2.3:o:flir:flir_ax8_firmware:1.46.7:*:*:*:*:*:*:*",
              "cpe:2.3:o:flir:flir_ax8_firmware:1.46.8:*:*:*:*:*:*:*",
              "cpe:2.3:o:flir:flir_ax8_firmware:1.46.9:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "flir_ax8_firmware",
            "vendor": "flir",
            "versions": [
              {
                "status": "affected",
                "version": "1.46.0"
              },
              {
                "status": "affected",
                "version": "1.46.1"
              },
              {
                "status": "affected",
                "version": "1.46.10"
              },
              {
                "status": "affected",
                "version": "1.46.11"
              },
              {
                "status": "affected",
                "version": "1.46.12"
              },
              {
                "status": "affected",
                "version": "1.46.13"
              },
              {
                "status": "affected",
                "version": "1.46.14"
              },
              {
                "status": "affected",
                "version": "1.46.15"
              },
              {
                "status": "affected",
                "version": "1.46.16"
              },
              {
                "status": "affected",
                "version": "1.46.2"
              },
              {
                "status": "affected",
                "version": "1.46.3"
              },
              {
                "status": "affected",
                "version": "1.46.4"
              },
              {
                "status": "affected",
                "version": "1.46.5"
              },
              {
                "status": "affected",
                "version": "1.46.6"
              },
              {
                "status": "affected",
                "version": "1.46.7"
              },
              {
                "status": "affected",
                "version": "1.46.8"
              },
              {
                "status": "affected",
                "version": "1.46.9"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-3013",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-03-28T18:31:24.496579Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-08-12T13:33:55.786Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "modules": [
            "User Registration"
          ],
          "product": "AX8",
          "vendor": "Teledyne FLIR",
          "versions": [
            {
              "status": "affected",
              "version": "1.46.0"
            },
            {
              "status": "affected",
              "version": "1.46.1"
            },
            {
              "status": "affected",
              "version": "1.46.2"
            },
            {
              "status": "affected",
              "version": "1.46.3"
            },
            {
              "status": "affected",
              "version": "1.46.4"
            },
            {
              "status": "affected",
              "version": "1.46.5"
            },
            {
              "status": "affected",
              "version": "1.46.6"
            },
            {
              "status": "affected",
              "version": "1.46.7"
            },
            {
              "status": "affected",
              "version": "1.46.8"
            },
            {
              "status": "affected",
              "version": "1.46.9"
            },
            {
              "status": "affected",
              "version": "1.46.10"
            },
            {
              "status": "affected",
              "version": "1.46.11"
            },
            {
              "status": "affected",
              "version": "1.46.12"
            },
            {
              "status": "affected",
              "version": "1.46.13"
            },
            {
              "status": "affected",
              "version": "1.46.14"
            },
            {
              "status": "affected",
              "version": "1.46.15"
            },
            {
              "status": "affected",
              "version": "1.46.16"
            },
            {
              "status": "unaffected",
              "version": "1.49.16"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "H0e4a0r1t (VulDB User)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A flaw has been found in Teledyne FLIR AX8 up to 1.46.16. The impacted element is an unknown function of the file /tools/test_login.php?action=register of the component User Registration. Executing manipulation can lead to improper authorization. The attack may be performed from remote. The exploit has been published and may be used. Upgrading to version 1.49.16 is sufficient to resolve this issue. Upgrading the affected component is recommended. The vendor points out: \"FLIR AX8 internal web site has been refactored to be able to handle the reported vulnerabilities.\""
        },
        {
          "lang": "de",
          "value": "In Teledyne FLIR AX8 up to 1.46.16 ist eine Schwachstelle entdeckt worden. Betroffen davon ist eine unbekannte Funktion der Datei /tools/test_login.php?action=register der Komponente User Registration. Die Bearbeitung verursacht improper authorization. Umgesetzt werden kann der Angriff \u00fcber das Netzwerk. Die Ausnutzung wurde ver\u00f6ffentlicht und kann verwendet werden. Mit einem Upgrade auf Version 1.49.16 l\u00e4sst sich dieses Problem beheben. Die Aktualisierung der betroffenen Komponente wird empfohlen."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
            "version": "4.0"
          }
        },
        {
          "cvssV3_1": {
            "baseScore": 6.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C",
            "version": "3.1"
          }
        },
        {
          "cvssV3_0": {
            "baseScore": 6.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C",
            "version": "3.0"
          }
        },
        {
          "cvssV2_0": {
            "baseScore": 6.5,
            "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:OF/RC:C",
            "version": "2.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-285",
              "description": "Improper Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-266",
              "description": "Incorrect Privilege Assignment",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-10-15T13:18:50.593Z",
        "orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
        "shortName": "VulDB"
      },
      "references": [
        {
          "name": "VDB-258299 | Teledyne FLIR AX8 User Registration test_login.php improper authorization",
          "tags": [
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://vuldb.com/?id.258299"
        },
        {
          "name": "VDB-258299 | CTI Indicators (IOB, IOC, TTP, IOA)",
          "tags": [
            "signature",
            "permissions-required"
          ],
          "url": "https://vuldb.com/?ctiid.258299"
        },
        {
          "name": "Submit #301588 | FLIR FLIR-AX8 Fixed Thermal Cameras 1.46.16 and below Register any user in the background",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/?submit.301588"
        },
        {
          "tags": [
            "broken-link",
            "exploit"
          ],
          "url": "https://h0e4a0r1t.github.io/2024/vulns/FLIR-AX8%20Fixed%20Thermal%20Cameras%20Register%20any%20user%20in%20the%20background--test_login.php.pdf"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2024-03-27T00:00:00.000Z",
          "value": "Advisory disclosed"
        },
        {
          "lang": "en",
          "time": "2024-03-27T00:00:00.000Z",
          "value": "CVE reserved"
        },
        {
          "lang": "en",
          "time": "2024-03-27T01:00:00.000Z",
          "value": "VulDB entry created"
        },
        {
          "lang": "en",
          "time": "2025-10-15T15:23:29.000Z",
          "value": "VulDB entry last update"
        }
      ],
      "title": "Teledyne FLIR AX8 User Registration test_login.php improper authorization"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
    "assignerShortName": "VulDB",
    "cveId": "CVE-2024-3013",
    "datePublished": "2024-03-28T00:31:04.101Z",
    "dateReserved": "2024-03-27T14:18:45.366Z",
    "dateUpdated": "2025-10-15T13:18:50.593Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

VAR-202403-1099

CVE-2024-3013 (GCVE-0-2024-3013)

Tags

Sightings

Nomenclature