Riskcovery

CVE-2025-7578

Teledyne FLIR FB-Series O/FLIR FH-Series ID runcmd.sh sendCommand command injection

State
Published
Severity
2.3 Low
Published
Jul 14, 2025
Updated
Jul 14, 2025
Reserved
Jul 13, 2025

Read the record on cve.org

Description

A vulnerability was found in Teledyne FLIR FB-Series O and FLIR FH-Series ID 1.3.2.16. It has been declared as critical. This vulnerability affects the function sendCommand of the file runcmd.sh. The manipulation of the argument cmd leads to command injection. The attack can be initiated remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The researcher highlights, that "[a]lthough this functionality is currently disabled due to server CGI configuration errors, it is essentially a 'time bomb' waiting to be activated". The vendor was contacted early about this disclosure but did not respond in any way.

Scores

CVSSScoreVectorSource
4.02.3 LowCVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:XVulDB
3.15.0 MediumCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L/E:X/RL:X/RC:RVulDB
3.05.0 MediumCVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L/E:X/RL:X/RC:RVulDB
2.04.6 MediumAV:N/AC:H/Au:S/C:P/I:P/A:P/E:ND/RL:ND/RC:URVulDB

Weaknesses

Affected Products

ProductVersions
FLIR FB-Series OTeledyne
  • 1.3.2.16Affected
FLIR FH-Series IDTeledyne
  • 1.3.2.16Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.