CVE-2022-37063 in AX8
Summary
by MITRE
All FLIR AX8 thermal sensor cameras versions up to and including 1.46.16 are vulnerable to Cross Site Scripting (XSS) due to improper input sanitization. An authenticated remote attacker can execute arbitrary JavaScript code in the web management interface. A successful exploit could allow the attacker to insert malicious JavaScript code.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/17/2025
The FLIR AX8 thermal sensor camera represents a critical endpoint device used in industrial and security applications where thermal imaging capabilities are essential for monitoring and detection purposes. These devices operate with web-based management interfaces that allow authorized users to configure settings, view live feeds, and manage system parameters remotely. The vulnerability exists within the web management interface of versions 1.46.16 and earlier, where insufficient input validation mechanisms fail to properly sanitize user-supplied data before processing. This flaw specifically manifests as a cross site scripting vulnerability that affects the device's web interface, creating a potential attack vector for malicious actors who can leverage this weakness to compromise the device's security posture.
The technical implementation of this vulnerability stems from improper input sanitization practices within the web application layer of the FLIR AX8 firmware. When authenticated users interact with the management interface, the system fails to adequately filter or escape user input parameters, particularly those submitted through web forms or URL parameters. This inadequate sanitization allows malicious JavaScript code to be injected and subsequently executed within the context of the victim's browser session. The vulnerability is classified as authenticated XSS because attackers must first establish valid credentials to access the web interface, but once authenticated, they can manipulate the system through malicious input injection techniques that bypass standard security controls.
The operational impact of this vulnerability extends beyond simple code execution, as it provides attackers with persistent access to the device's management interface with the privileges of the authenticated user. Successful exploitation could enable attackers to perform unauthorized configuration changes, access sensitive thermal imaging data, modify system settings, or establish persistent backdoors within the device. The attack surface is particularly concerning given that thermal sensor cameras are often deployed in critical infrastructure environments where they serve as essential monitoring tools. The vulnerability's presence in versions up to 1.46.16 suggests this weakness has persisted across multiple firmware releases, indicating potential design flaws in the input validation mechanisms rather than isolated coding errors.
From a cybersecurity perspective, this vulnerability aligns with CWE-79 which describes cross site scripting flaws in web applications, and maps to ATT&CK technique T1566 which covers spearphishing with malicious attachments and links. The authenticated nature of the attack requires attackers to first compromise valid credentials through social engineering, credential stuffing, or other means, but once obtained, they can leverage this vulnerability to escalate privileges and maintain persistent access to the device. Organizations deploying FLIR AX8 cameras should implement immediate mitigation measures including firmware updates to versions that address this vulnerability, network segmentation to limit access to management interfaces, and monitoring for suspicious activity within the device's web interface. Additionally, regular security assessments of industrial IoT devices should include thorough input validation testing to identify similar vulnerabilities that could compromise operational technology environments.
The broader implications of this vulnerability highlight the critical importance of secure coding practices in industrial IoT devices where security is often secondary to functionality and ease of use. Many industrial security cameras and sensors suffer from similar input validation weaknesses due to rushed development cycles or insufficient security testing during the product lifecycle. The attack vector demonstrates how even authenticated access can be leveraged for persistent compromise, making this vulnerability particularly dangerous in environments where cameras are deployed with minimal network security controls. Security professionals should consider implementing comprehensive device management policies that include regular firmware updates, privileged access controls, and continuous monitoring of device interfaces to prevent exploitation of similar vulnerabilities in other industrial IoT deployments.