FLIR Systems AX8 Cameras Improper Access Control (CVE-2025-6266)

medium Tenable OT Security Plugin ID 505183

Synopsis

The remote OT asset is affected by a vulnerability.

Description

A vulnerability was detected in Teledyne FLIR AX8 up to 1.46. Affected by this vulnerability is an unknown functionality of the file /upload.php. Performing manipulation of the argument File results in unrestricted upload. It is possible to initiate the attack remotely.
The exploit is now public and may be used. Upgrading to version 1.49.16 addresses this issue. Upgrading the affected component is recommended. The vendor points out: FLIR AX8 internal web site has been refactored to be able to handle the reported vulnerabilities.

This plugin only works with Tenable.ot.
Please visit https://www.tenable.com/products/tenable-ot for more information.

Solution

Refer to the vendor advisory.

Plugin Details

Severity: Medium

ID: 505183

File Name: tenable_ot_flirsystems_CVE-2025-6266.nasl

Version: 1.2

Type: remote

Family: Tenable.ot

Published: 2/19/2026

Updated: 2/20/2026

Supported Sensors: Tenable OT Security

Risk Information

VPR

Risk Factor: Medium

Score: 6.7

CVSS v2

Risk Factor: Critical

Base Score: 10

Temporal Score: 7.8

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

CVSS Score Source: CVE-2025-6266

CVSS v3

Risk Factor: Critical

Base Score: 9.8

Temporal Score: 8.8

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

CVSS v4

Risk Factor: Medium

Base Score: 5.3

Threat Score: 2.1

Threat Vector: CVSS:4.0/E:P

Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Vulnerability Information

CPE: cpe:/o:flir:flir_ax8_firmware

Required KB Items: Tenable.ot/FLIRSystems

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 6/19/2025

Vulnerability Publication Date: 6/19/2025

Reference Information

CVE: CVE-2025-6266

CWE: 284, 434

Detections

Analytics