Teledyne FLIR AX8 up to 1.46.16 User Registration test_login.php?action=register improper authorization

Summaryinfo

A vulnerability classified as critical has been found in Teledyne FLIR AX8 up to 1.46.16. This affects an unknown function of the file /tools/test_login.php?action=register of the component User Registration. The manipulation leads to improper authorization. This vulnerability is traded as CVE-2024-3013. It is possible to initiate the attack remotely. Furthermore, there is an exploit available. It is recommended to upgrade the affected component. The vendor points out: "FLIR AX8 internal web site has been refactored to be able to handle the reported vulnerabilities."

Detailsinfo

A vulnerability was found in Teledyne FLIR AX8 up to 1.46.16. It has been rated as critical. This issue affects some unknown processing of the file /tools/test_login.php?action=register of the component User Registration. The manipulation with an unknown input leads to a improper authorization vulnerability. Using CWE to declare the problem leads to CWE-285. The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action. Impacted is confidentiality, integrity, and availability.

It is possible to read the advisory at h0e4a0r1t.github.io. The identification of this vulnerability is CVE-2024-3013. The exploitation is known to be easy. The attack may be initiated remotely. Technical details as well as a public exploit are known. The attack technique deployed by this issue is T1548.002 according to MITRE ATT&CK.

The exploit is available at h0e4a0r1t.github.io. It is declared as proof-of-concept. The vendor points out: "FLIR AX8 internal web site has been refactored to be able to handle the reported vulnerabilities."

Upgrading to version 1.49.16 eliminates this vulnerability.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Vendor

• Teledyne FLIR

Name

• AX8

Version

• 1.46.0
• 1.46.1
• 1.46.2
• 1.46.3
• 1.46.4
• 1.46.5
• 1.46.6
• 1.46.7
• 1.46.8
• 1.46.9
• 1.46.10
• 1.46.11
• 1.46.12
• 1.46.13
• 1.46.14
• 1.46.15
• 1.46.16

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Submitinfo

Accepted

• Submit #301588: FLIR FLIR-AX8 Fixed Thermal Cameras 1.46.16 and below Register any user in the background (by H0e4a0r1t)

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion