Detections
Analytics
FLIR Systems AX8 Cameras Improper Access Control (CVE-2025-6266)
critical Tenable OT Security Plugin ID 505183
Synopsis
The remote OT asset is affected by a vulnerability.Description
A vulnerability was detected in Teledyne FLIR AX8 up to 1.46. Affected by this vulnerability is an unknown functionality of the file /upload.php. Performing manipulation of the argument File results in unrestricted upload. It is possible to initiate the attack remotely.The exploit is now public and may be used. Upgrading to version 1.49.16 addresses this issue. Upgrading the affected component is recommended. The vendor points out: FLIR AX8 internal web site has been refactored to be able to handle the reported vulnerabilities.
This plugin only works with Tenable.ot.
Please visit https://www.tenable.com/products/tenable-ot for more information.
Solution
Refer to the vendor advisory.See Also
http://www.nessus.org/u?50faf15f
Plugin Details
Severity: Critical
ID: 505183
File Name: tenable_ot_flirsystems_CVE-2025-6266.nasl
Version: 1.1
Type: remote
Family: Tenable.ot
Published: 2/19/2026
Updated: 2/19/2026
Supported Sensors: Tenable OT Security
Risk Information
VPR
Risk Factor: Medium
Score: 6.7
CVSS v3
Risk Factor: Critical
Base Score: 9.8
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Vulnerability Information
CPE: cpe:/o:flir:flir_ax8_firmware
Required KB Items: Tenable.ot/FLIRSystems
Exploit Ease: No known exploits are available
Patch Publication Date: 6/19/2025
Vulnerability Publication Date: 6/19/2025
Reference Information
CVE: CVE-2025-6266