CVE-2025-7578: Teledyne FLIR FB-Series O/FLIR FH-Series ID runcmd.sh sendCommand command injection
A vulnerability was found in Teledyne FLIR FB-Series O and FLIR FH-Series ID 1.3.2.16. It has been declared as critical. This vulnerability affects the function sendCommand of the file runcmd.sh. The manipulation of the argument cmd leads to command injection. The attack can be initiated remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The researcher highlights, that "[a]lthough this functionality is currently disabled due to server CGI configuration errors, it is essentially a 'time bomb' waiting to be activated". The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-7578?
CVE-2025-7578 is classified as critical due to the potential for command injection.
How do I fix CVE-2025-7578?
To remediate CVE-2025-7578, update to the latest version of Teledyne FLIR FB-Series O or FLIR FH-Series ID software that addresses this vulnerability.
What types of products are affected by CVE-2025-7578?
CVE-2025-7578 affects the Teledyne FLIR FB-Series O and FLIR FH-Series ID products.
What kind of attack can be executed due to CVE-2025-7578?
CVE-2025-7578 allows for command injection attacks through the exploitation of the sendCommand function.
What is the potential impact of CVE-2025-7578?
The impact of CVE-2025-7578 includes the unauthorized execution of commands on affected devices.