CVE-2023-29861

CRITICAL

An issue found in FLIR-DVTEL version not specified allows a remote attacker to execute arbitrary code via a crafted request to the management page of the device.

Affects 2 products across 1 vendor.

BCS7.7
CVSS 3.19.8
EPSS1.8%
Percentile76th
PatchUnknown
CVSS Vector — Plain English Remotely exploitable over the network, low complexity, no authentication required, no user interaction needed, impact contained to the vulnerable component, full confidentiality impact, full integrity impact, full availability impact.
CWE Weakness Definitions
CWE-94: Code Injection

Attacker injects arbitrary code that is executed by the application process.

Related Attack Patterns (CAPEC)
CAPEC-35 Leverage Executable Code in Non-Executable Files
via CWE-94
CAPEC-77 Manipulating User-Controlled Variables
via CWE-94
CAPEC-242 Code Injection
via CWE-94

Mapping is CWE-to-CAPEC per MITRE CAPEC 3.9.

◆ SAGE Intelligence — CITED Relevance Research Team

A critical vulnerability in FLIR-DVTEL devices allows remote attackers to execute arbitrary code through a crafted request to the management page, posing a significant risk to system integrity and security.

BSID: BS-2023-GLOBAL-350619-C • Model: /workspace/models/qwen2.5-coder-32b-instruct-bf16 • Confidence: HIGH

Is this CVE in your environment?

BreachSpider monitors your ICS/OT environment for vulnerabilities like this one. No agents or network access required. Free to start.

Check My Environment →
Frequently Asked Questions
What is CVE-2023-29861?
A critical vulnerability in FLIR-DVTEL devices allows remote attackers to execute arbitrary code through a crafted request to the management page, posing a significant risk to system integrity and security.
What is the CVSS score for CVE-2023-29861?
CVE-2023-29861 has CVSS 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS: 1.8%.
Is CVE-2023-29861 actively exploited?
No confirmed active exploitation of CVE-2023-29861 as of 2026-05-30.
How do I remediate CVE-2023-29861?
Priority: IMMEDIATE.
What systems are affected by CVE-2023-29861?
CVE-2023-29861 affects: Flir, Flir.
Vulnerability Details
CVE IDCVE-2023-29861
BSIDBS-2023-GLOBAL-350619-C BreachSpider Global ID
CVSS VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Published2023-05-15
Last Modified2025-01-31
ICS Relevance15%
Weakness (CWE)
Code Injection
SourceNVD
Official Description

An issue found in FLIR-DVTEL version not specified allows a remote attacker to execute arbitrary code via a crafted request to the management page of the device.

Source: NIST NVD / MITRE CVE Database

Attack Vector Analysis — CITED Relevance

The attack vector involves sending a specially crafted HTTP request to the management interface of the FLIR-DVTEL device. This request can exploit the vulnerability to execute arbitrary code with the privileges of the application.

Exploitation Likelihood: CRITICAL

Affected Products
VendorProductFixed Version
Flir Dvtel Camera Firmware —
Flir Dvtel Camera —
Remediation

No patch URL on record. Monitor vendor security advisories directly.

Threat Intelligence
● Threat Intelligence Validated: August 2026 | Threat Age: 1181 Days
CISA KEVNot in KEV catalog
Public ExploitNot confirmed
PoC CodeNot confirmed
SAGE Enrichment Record — provenance & audit hash
Model/workspace/models/qwen2.5-coder-32b-instruct-bf16
ConfidenceHIGH
Enriched At2026-05-24
SHA-512 Audit Hash628ae822ccdc8a04ebf5a6b85dff6afd4a2274101a39d3a159d60964de0c681f256d6153327e546ee5572db4722ed49757ba94b9fc089afc00a63f34d30d4a7c
Related CVEs affecting Flir
CVE-2022-4364 9.8 A vulnerability has been found in Teledyne FLIR AX8 up to 1.46.16. Affected b... CVE-2023-51126 9.8 Command injection vulnerability in /usr/www/res.php in FLIR AX8 up to 1.46.16... CVE-2022-37061 9.8 All FLIR AX8 thermal sensor cameras version up to and including 1.46.16 are v... CVE-2018-3813 9.8 getConfigExportFile.cgi on FLIR Brickstream 2300 devices 2.0 4.1.53.166 has I... CVE-2025-6266 9.8 A vulnerability was detected in Teledyne FLIR AX8 up to 1.46. Affected by thi...
View all Flir CVEs →

Critical Severity - Know Your Exposure

A CVSS 9.8 vulnerability in your ICS environment cannot wait. BreachSpider maps critical CVEs to your specific assets and tells you what to fix first.

Check Your Assets Free →