CVE-2018-25139
FLIR AX8 Thermal Camera 1.32.16 Unauthenticated RTSP Stream Disclosure
- State
- Published
- Severity
- 8.7 High
- Published
- Dec 24, 2025
- Updated
- Oct 1, 2026
- Reserved
- Dec 24, 2025
Description
FLIR AX8 Thermal Camera 1.32.16 contains an unauthenticated vulnerability that allows remote attackers to access live video streams without credentials. Attackers can directly connect to the RTSP stream using tools like VLC or FFmpeg to view and record thermal camera footage.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 8.7 High | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 7.5 High | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N | VulnCheck |
Weaknesses
- CWE-306 Missing Authentication for Critical Function
Affected Products
| Product | Versions |
|---|---|
FLIR AX8 Thermal CameraFLIR Systems, Inc. |
|
References
- ExploitDB-45606exploit
- FLIR Systems Official Product Homepageproduct
- Zero Science Lab Disclosure (ZSL-2018-5492)third-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.