CVE-2017-20216
FLIR Thermal Camera PT-Series firmware version 8.0.0.64 Unauthenticated Remote Command Injection
- State
- Published
- Severity
- 9.3 Critical
- Published
- Jan 7, 2026
- Updated
- Apr 7, 2026
- Reserved
- Jan 6, 2026
Description
FLIR Thermal Camera PT-Series firmware version 8.0.0.64 contains multiple unauthenticated remote command injection vulnerabilities in the controllerFlirSystem.php script. Attackers can execute arbitrary system commands as root by exploiting unsanitized POST parameters in the execFlirSystem() function through shell_exec() calls. Exploitation evidence was observed by the Shadowserver Foundation on 2026-01-06 (UTC).
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 9.3 Critical | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 9.8 Critical | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H | VulnCheck |
Weaknesses
- CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Affected Products
| Product | Versions |
|---|---|
FLIR Thermal Camera PT-SeriesFLIR Systems, Inc. |
|
References
- Zero Science Lab Vulnerability Advisorythird-party-advisory
- Exploit Database Entry 42785exploit
- Packet Storm Security Exploit Archiveexploit
- CXSecurity Vulnerability Listingthird-party-advisory
- Archived FLIR Security Advisoryvendor-advisorypatch
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.