CVE-2018-25140

FLIR Thermal Traffic Cameras V1.01-0bb5b27 Unauthenticated Websocket Device Manipulation

State: Published
Severity: 9.3 Critical
Published: Dec 24, 2025
Updated: Dec 24, 2025
Reserved: Dec 24, 2025

Description

FLIR thermal traffic cameras contain an unauthenticated device manipulation vulnerability in their WebSocket implementation that allows attackers to bypass authentication and authorization controls. Attackers can directly modify device configurations, access system information, and potentially initiate denial of service by sending crafted WebSocket messages without authentication.

Scores

CVSS	Score	Vector	Source
4.0	9.3 Critical	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N	VulnCheck
3.1	7.5 High	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N	VulnCheck

Weaknesses

CWE-306 Missing Authentication for Critical Function

Affected Products

Product	Versions
Thermal Traffic CamerasFLIR Systems, Inc.	V1.01-0bb5b27Affected E1.00.09Affected V1.02.P01Affected V1.05.P01Affected V1.04.P02Affected V1.04Affected V1.01.P02Affected V1.05.P03Affected V1.06Affected V1.02.P02Affected

References

ExploitDB-45539exploit
FLIR Systems Official Websiteproduct
Zero Science Lab Disclosure (ZSL-2018-5490)third-party-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.