CVE-2023-51126
Last modified
CVE-2023-51126 is a critical-severity vulnerability rated 9.8/10 on the CVSS scale. Command injection vulnerability in /usr/www/res.php in FLIR AX8 up to 1.46.16 allows attackers to run arbitrary commands via the value parameter. NOTE: The vendor has stated that with the introduction of firmware version 1.49.16 (Jan 2023) the FLIR AX8 should no longer be affected by the vulnerability reported. EPSS estimates a 31.10% chance of exploitation in the next 30 days.
Description
Command injection vulnerability in /usr/www/res.php in FLIR AX8 up to 1.46.16 allows attackers to run arbitrary commands via the value parameter. NOTE: The vendor has stated that with the introduction of firmware version 1.49.16 (Jan 2023) the FLIR AX8 should no longer be affected by the vulnerability reported. Latest firmware version (as of Oct 2025, was released Jun 2024) is 1.55.16.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Flir | Flir Ax8 Firmware | <= 1.46.16 |
References
- https://github.com/risuxx/CVE-2023-51126Third Party Advisory
- https://github.com/risuxx/CVE-2023-51126Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2023-51126?
How severe is CVE-2023-51126?
How do I fix CVE-2023-51126?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2023
- CVE-2023-51105A floating point exception (divide-by-zero) vulnerability wa…7.5
- CVE-2023-51106A floating point exception (divide-by-zero) vulnerability wa…7.5
- CVE-2023-51107A floating point exception (divide-by-zero) vulnerability wa…7.5
- CVE-2023-5111Os Commerce is currently susceptible to a Cross-Site Scripti…5.4
- CVE-2023-5112Os Commerce is currently susceptible to a Cross-Site Scripti…5.4
- CVE-2023-51123An issue discovered in D-Link dir815 v.1.01SSb08.bin allows …9.8
- CVE-2023-51127FLIR AX8 thermal sensor cameras up to and including 1.46.16 …7.5
- CVE-2023-5113Certain HP Enterprise LaserJet and HP LaserJet Managed Print…6.1
- CVE-2023-51133TOTOLINK X2000R Gh v1.0.0-B20230221.0948.web was discovered …9.8
- CVE-2023-51135TOTOLINK X2000R Gh v1.0.0-B20230221.0948.web was discovered …9.8
- CVE-2023-51136TOTOLINK X2000R Gh v1.0.0-B20230221.0948.web was discovered …9.8
- CVE-2023-5114The idbbee plugin for WordPress is vulnerable to Stored Cros…5.4
Are you affected by CVE-2023-51126?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST