CVE-2022-37062

All FLIR AX8 thermal sensor cameras version up to and including 1.46.16 are affected by an insecure design vulnerability due to an improper directory access restriction. An unauthenticated, remote attacker can exploit this by sending a URI that contains the path of the SQLite users database and download it. A successful exploit could allow the attacker to extract usernames and hashed passwords. NOTE: The vendor has stated that with the introduction of firmware version 1.49.16 (Jan 2023) the FLIR AX8 should no longer be affected by the vulnerability reported. Latest firmware version (as of Oct 2025, was released Jun 2024) is 1.55.16.

• CWE-306

• http://packetstormsecurity.com/files/168116/FLIR-AX8-1.46.16-Traversal-Access-Control-Command-Injection-XSS.htmlBroken Link
• https://gist.github.com/Nwqda/9e16852ab7827dc62b8e44d6180a6899Exploit, Mitigation, Third Party Advisory
• https://www.flir.com/products/ax8-automation/Product, Vendor Advisory
• http://packetstormsecurity.com/files/168116/FLIR-AX8-1.46.16-Traversal-Access-Control-Command-Injection-XSS.htmlBroken Link
• https://gist.github.com/Nwqda/9e16852ab7827dc62b8e44d6180a6899Exploit, Mitigation, Third Party Advisory
• https://www.flir.com/products/ax8-automation/Product, Vendor Advisory

Published

Aug 18, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-37056D-Link GO-RT-AC750 GORTAC750_revA_v101b03 and GO-RT-AC750_re…9.8
• CVE-2022-37057D-Link Go-RT-AC750 GORTAC750_revA_v101b03 and GO-RT-AC750_re…9.8
• CVE-2022-37059Cross Site Scripting (XSS) in Admin Panel of Subrion CMS 4.2…4.8
• CVE-2022-3706Improper authorization in GitLab CE/EE affecting all version…4.3
• CVE-2022-37060FLIR AX8 thermal sensor cameras version up to and including …7.5
• CVE-2022-37061All FLIR AX8 thermal sensor cameras version up to and includ…9.8
• CVE-2022-37063All FLIR AX8 thermal sensor cameras versions up to and inclu…5.4
• CVE-2022-37066H3C GR-1200W MiniGRW1A0V100R006 was discovered to contain a …9.8
• CVE-2022-37067H3C GR-1200W MiniGRW1A0V100R006 was discovered to contain a …9.8
• CVE-2022-37068H3C GR-1200W MiniGRW1A0V100R006 was discovered to contain a …9.8
• CVE-2022-37069H3C GR-1200W MiniGRW1A0V100R006 was discovered to contain a …9.8
• CVE-2022-3707A double-free memory flaw was found in the Linux kernel. The…5.5