CVE-2023-51127
Last modified
CVE-2023-51127 is a high-severity vulnerability rated 7.5/10 on the CVSS scale. FLIR AX8 thermal sensor cameras up to and including 1.46.16 are vulnerable to Directory Traversal due to improper access restriction. This vulnerability allows an unauthenticated, remote attacker to obtain arbitrary sensitive file contents by uploading a specially crafted symbolic link file. EPSS estimates a 1.25% chance of exploitation in the next 30 days.
Description
FLIR AX8 thermal sensor cameras up to and including 1.46.16 are vulnerable to Directory Traversal due to improper access restriction. This vulnerability allows an unauthenticated, remote attacker to obtain arbitrary sensitive file contents by uploading a specially crafted symbolic link file. NOTE: The vendor has stated that with the introduction of firmware version 1.49.16 (Jan 2023) the FLIR AX8 should no longer be affected by the vulnerability reported. Latest firmware version (as of Oct 2025, was released Jun 2024) is 1.55.16.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Flir | Flir Ax8 Firmware | 1.46.16 |
References
- https://github.com/risuxx/CVE-2023-51127Third Party Advisory
- https://github.com/risuxx/CVE-2023-51127Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2023-51127?
How severe is CVE-2023-51127?
How do I fix CVE-2023-51127?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2023
- CVE-2023-51106A floating point exception (divide-by-zero) vulnerability wa…7.5
- CVE-2023-51107A floating point exception (divide-by-zero) vulnerability wa…7.5
- CVE-2023-5111Os Commerce is currently susceptible to a Cross-Site Scripti…5.4
- CVE-2023-5112Os Commerce is currently susceptible to a Cross-Site Scripti…5.4
- CVE-2023-51123An issue discovered in D-Link dir815 v.1.01SSb08.bin allows …9.8
- CVE-2023-51126Command injection vulnerability in /usr/www/res.php in FLIR …9.8
- CVE-2023-5113Certain HP Enterprise LaserJet and HP LaserJet Managed Print…6.1
- CVE-2023-51133TOTOLINK X2000R Gh v1.0.0-B20230221.0948.web was discovered …9.8
- CVE-2023-51135TOTOLINK X2000R Gh v1.0.0-B20230221.0948.web was discovered …9.8
- CVE-2023-51136TOTOLINK X2000R Gh v1.0.0-B20230221.0948.web was discovered …9.8
- CVE-2023-5114The idbbee plugin for WordPress is vulnerable to Stored Cros…5.4
- CVE-2023-51141An issue in ZKTeko BioTime v.8.5.4 and before allows a remot…6.5
Are you affected by CVE-2023-51127?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST