CVE-2023-51126

CVE Database · CVE-2023-51126

CVE-2023-51126

· CRITICALModified

CVSS v3.1

9.8

EPSS

31.10%

Published

Jan 10, 2024

Modified

Oct 17, 2025

Public PoC / Exploit (1)

All weaponized →

TrickestTrickest PoC index

Links to public security research (Exploit-DB, Nuclei, Trickest, GitHub) for defensive use only.

Description

Command injection vulnerability in /usr/www/res.php in FLIR AX8 up to 1.46.16 allows attackers to run arbitrary commands via the value parameter. NOTE: The vendor has stated that with the introduction of firmware version 1.49.16 (Jan 2023) the FLIR AX8 should no longer be affected by the vulnerability reported. Latest firmware version (as of Oct 2025, was released Jun 2024) is 1.55.16.

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)

CWE-77CWE-77

Affected Products (2)

flir · flir_ax8_firmwarevulnerable

flir · flir_ax8

References (2)

https://github.com/risuxx/CVE-2023-51126

Third Party Advisory

https://github.com/risuxx/CVE-2023-51126

Third Party Advisory

KEV Catalog EPSS Scores Vendors All CVEs