CVE-2025-5127: Teledyne FLIR AX8 prod.php cross site scripting
A vulnerability was determined in Teledyne FLIR AX8 up to 1.46.16. This issue affects some unknown processing of the file /prod.php. Executing manipulation of the argument cmd can lead to cross site scripting. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized. Upgrading to version 1.49.16 is capable of addressing this issue. It is recommended to upgrade the affected component. The vendor points out: "FLIR AX8 internal web site has been refactored to be able to handle the reported vulnerabilities."
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-5127?
CVE-2025-5127 is classified as a problematic vulnerability with a significant impact potential.
How does CVE-2025-5127 affect the FLIR AX8?
CVE-2025-5127 affects the FLIR AX8 by allowing cross-site scripting through the manipulation of the cmd argument in the /prod.php file.
Can CVE-2025-5127 be exploited remotely?
Yes, the exploit for CVE-2025-5127 can be initiated remotely.
What versions of FLIR AX8 are affected by CVE-2025-5127?
CVE-2025-5127 affects FLIR AX8 versions up to and including 1.46.16.
How can organizations mitigate the risks associated with CVE-2025-5127?
Organizations can mitigate the risks of CVE-2025-5127 by applying necessary security patches or updates to FLIR AX8 to prevent exploitation.