CVE-2022-37061

All FLIR AX8 thermal sensor cameras version up to and including 1.46.16 are vulnerable to Remote Command Injection. This can be exploited to inject and execute arbitrary shell commands as the root user through the id HTTP POST parameter in the res.php endpoint. A successful exploit could allow the attacker to execute arbitrary commands on the underlying operating system with the root privileges. NOTE: The vendor has stated that with the introduction of firmware version 1.49.16 (Jan 2023) the FLIR AX8 should no longer be affected by the vulnerability reported. Latest firmware version (as of Oct 2025, was released Jun 2024) is 1.55.16.

• CWE-78

• http://packetstormsecurity.com/files/168114/FLIX-AX8-1.46.16-Remote-Command-Execution.htmlExploit, Third Party Advisory, VDB Entry
• http://packetstormsecurity.com/files/168116/FLIR-AX8-1.46.16-Traversal-Access-Control-Command-Injection-XSS.htmlExploit, Third Party Advisory, VDB Entry
• http://packetstormsecurity.com/files/169701/FLIR-AX8-1.46.16-Remote-Command-Injection.htmlExploit, Third Party Advisory, VDB Entry
• https://gist.github.com/Nwqda/9e16852ab7827dc62b8e44d6180a6899Exploit, Mitigation, Third Party Advisory
• https://github.com/WlX-33/PoC-for-CVE/blob/main/CVE-2022-36266/FLIR%20AX8%20Unauthenticated%20OS%20Command%20Injection.py
• https://www.flir.com/products/ax8-automation/Product, Vendor Advisory
• https://www.zeroscience.mk/en/vulnerabilities/ZSL-2018-5491.phpExploit, Third Party Advisory
• http://packetstormsecurity.com/files/168114/FLIX-AX8-1.46.16-Remote-Command-Execution.htmlExploit, Third Party Advisory, VDB Entry
• http://packetstormsecurity.com/files/168116/FLIR-AX8-1.46.16-Traversal-Access-Control-Command-Injection-XSS.htmlExploit, Third Party Advisory, VDB Entry
• http://packetstormsecurity.com/files/169701/FLIR-AX8-1.46.16-Remote-Command-Injection.htmlExploit, Third Party Advisory, VDB Entry
• https://gist.github.com/Nwqda/9e16852ab7827dc62b8e44d6180a6899Exploit, Mitigation, Third Party Advisory
• https://www.flir.com/products/ax8-automation/Product, Vendor Advisory
• https://www.zeroscience.mk/en/vulnerabilities/ZSL-2018-5491.phpExploit, Third Party Advisory

Published

Aug 18, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-37055D-Link Go-RT-AC750 GORTAC750_revA_v101b03 and GO-RT-AC750_re…9.8
• CVE-2022-37056D-Link GO-RT-AC750 GORTAC750_revA_v101b03 and GO-RT-AC750_re…9.8
• CVE-2022-37057D-Link Go-RT-AC750 GORTAC750_revA_v101b03 and GO-RT-AC750_re…9.8
• CVE-2022-37059Cross Site Scripting (XSS) in Admin Panel of Subrion CMS 4.2…4.8
• CVE-2022-3706Improper authorization in GitLab CE/EE affecting all version…4.3
• CVE-2022-37060FLIR AX8 thermal sensor cameras version up to and including …7.5
• CVE-2022-37062All FLIR AX8 thermal sensor cameras version up to and includ…7.5
• CVE-2022-37063All FLIR AX8 thermal sensor cameras versions up to and inclu…5.4
• CVE-2022-37066H3C GR-1200W MiniGRW1A0V100R006 was discovered to contain a …9.8
• CVE-2022-37067H3C GR-1200W MiniGRW1A0V100R006 was discovered to contain a …9.8
• CVE-2022-37068H3C GR-1200W MiniGRW1A0V100R006 was discovered to contain a …9.8
• CVE-2022-37069H3C GR-1200W MiniGRW1A0V100R006 was discovered to contain a …9.8