FLIR Systems AX8 Cameras Command Injection (CVE-2022-4364)

medium Tenable OT Security Plugin ID 505195

Synopsis

The remote OT asset is affected by a vulnerability.

Description

A vulnerability has been found in Teledyne FLIR AX8 up to 1.46.16.
Affected by this issue is some unknown functionality of the file palette.php of the component Web Service Handler. The manipulation of the argument palette leads to command injection. The attack is possible to be carried out remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 1.49.16 can resolve this issue. Upgrading the affected component is advised. The vendor points out: FLIR AX8 internal web site has been refactored to be able to handle the reported vulnerabilities.

This plugin only works with Tenable.ot.
Please visit https://www.tenable.com/products/tenable-ot for more information.

Solution

Refer to the vendor advisory.

Plugin Details

Severity: Medium

ID: 505195

File Name: tenable_ot_flirsystems_CVE-2022-4364.nasl

Version: 1.2

Type: remote

Family: Tenable.ot

Published: 2/19/2026

Updated: 2/20/2026

Supported Sensors: Tenable OT Security

Risk Information

VPR

Risk Factor: Medium

Score: 6.7

CVSS v2

Risk Factor: Critical

Base Score: 10

Temporal Score: 7.8

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

CVSS Score Source: CVE-2022-4364

CVSS v3

Risk Factor: Critical

Base Score: 9.8

Temporal Score: 8.8

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

CVSS v4

Risk Factor: Medium

Base Score: 6.9

Threat Score: 5.5

Threat Vector: CVSS:4.0/E:P

Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Vulnerability Information

CPE: cpe:/o:flir:flir_ax8_firmware

Required KB Items: Tenable.ot/FLIRSystems

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 12/8/2022

Vulnerability Publication Date: 12/8/2022

Reference Information

CVE: CVE-2022-4364

CWE: 74, 77, 78

Detections

Analytics