CVE-2022-4364 in AX8
Summary
by MITRE • 12/08/2022
A vulnerability classified as critical has been found in Teledyne FLIR AX8 up to 1.46.16. Affected is an unknown function of the file palette.php of the component Web Service Handler. The manipulation of the argument palette leads to command injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-215118 is the identifier assigned to this vulnerability.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/15/2025
The vulnerability identified as CVE-2022-4364 represents a critical command injection flaw within the Teledyne FLIR AX8 device firmware version 1.46.16 and earlier. This issue resides in the web service handler component, specifically within the palette.php file which processes palette-related parameters. The flaw manifests when an attacker manipulates the palette argument, enabling arbitrary command execution on the affected device. The vulnerability's remote exploitability means that malicious actors can trigger this command injection without physical access to the device, making it particularly dangerous in network-connected environments where such thermal imaging devices may be exposed to external threats.
The technical nature of this vulnerability aligns with CWE-77, which describes command injection flaws where untrusted data is incorporated into system commands without proper sanitization or validation. This weakness allows attackers to execute arbitrary operating system commands with the privileges of the web service process, potentially leading to complete system compromise. The attack vector through the web service handler component suggests that the vulnerability exists in the HTTP interface that manages device configuration and data processing functions. The exploitation requires minimal privileges to access the web service endpoint and manipulate the palette parameter, making it accessible to attackers with basic network reconnaissance capabilities.
The operational impact of this vulnerability extends beyond simple unauthorized access, as command injection attacks can enable attackers to execute malicious code, establish persistence mechanisms, and potentially escalate privileges within the device's operating environment. Given that thermal imaging devices like the FLIR AX8 are often deployed in critical infrastructure, industrial control systems, and security monitoring applications, a successful exploitation could compromise sensitive surveillance data, allow unauthorized access to monitoring systems, or even enable attackers to manipulate device behavior for reconnaissance purposes. The disclosure of the exploit and assignment of VDB-215118 identifier indicates that this vulnerability has reached public availability, increasing the likelihood of real-world exploitation.
Organizations should prioritize immediate remediation by updating to the latest firmware version that addresses this vulnerability, as no effective workarounds exist for this command injection flaw. Network segmentation and access controls should be implemented to limit exposure of affected devices to untrusted networks, while monitoring for suspicious web service activity and unauthorized access attempts should be enabled. The vulnerability demonstrates the importance of secure coding practices in embedded web interfaces and highlights the risks associated with insufficient input validation in device management components. Security teams should also consider implementing intrusion detection systems that can identify patterns associated with command injection attempts and maintain awareness of similar vulnerabilities in other device firmware components.