CVE-2023-51126

critical · 9.8

Command injection vulnerability in /usr/www/res.php in FLIR AX8 up to 1.46.16 allows attackers to run arbitrary commands via the value parameter. NOTE: The vendor has stated that with the introduction of firmware version 1.49.16 (Jan 2023) the FLIR AX8 should no longer be affected by the vulnerability reported. Latest firmware version (as of Oct 2025, was released Jun 2024) is 1.55.16.

9.8

CVSS

31.1%

EPSS (exploit prob.)

98th

EPSS percentile

2024-01-10

Published

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses

CWE-77

Affected products

Vendor	Product	Affected versions
flir	flir_ax8_firmware	<= 1.46.16
flir	flir_ax8	all versions

Check a specific version with /api/v1/cve/match.

References

https://github.com/risuxx/CVE-2023-51126
https://github.com/risuxx/CVE-2023-51126

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2023-51126