CVE-2023-51126

CRITICAL

Command injection vulnerability in /usr/www/res.php in FLIR AX8 up to 1.46.16 allows attackers to run arbitrary commands via the value parameter. NOTE: The vendor has stated that with the introduct...

Affects 2 products across 1 vendor.

BCS7.78
CVSS 3.19.8
EPSS31.1%
Percentile98th
PatchUnknown
CVSS Vector — Plain English Remotely exploitable over the network, low complexity, no authentication required, no user interaction needed, impact contained to the vulnerable component, full confidentiality impact, full integrity impact, full availability impact.
CWE Weakness Definitions
CWE-77: Command Injection

Attacker injects operating system commands through application inputs passed to a shell or system call.

Related Attack Patterns (CAPEC)
CAPEC-43 Exploiting Multiple Input Interpretation Layers
via CWE-77
CAPEC-76 Manipulating Web Input to File System Calls
via CWE-77
CAPEC-15 Command Delimiters
via CWE-77
CAPEC-40 Manipulating Writeable Terminal Devices
via CWE-77
CAPEC-75 Manipulating Writeable Configuration Files
via CWE-77
Show all 8
via CWE-77
via CWE-77
via CWE-77

Mapping is CWE-to-CAPEC per MITRE CAPEC 3.9.

◆ SAGE Intelligence — CITED Relevance Research Team

A command injection vulnerability exists in /usr/www/res.php in FLIR AX8 devices up to firmware version 1.46.16, allowing attackers to execute arbitrary commands via the value parameter.

BSID: BS-2024-GLOBAL-053051-C • Model: /workspace/models/qwen2.5-coder-32b-instruct-bf16 • Confidence: HIGH

Is this CVE in your environment?

BreachSpider monitors your ICS/OT environment for vulnerabilities like this one. No agents or network access required. Free to start.

Check My Environment →
Frequently Asked Questions
What is CVE-2023-51126?
A command injection vulnerability exists in /usr/www/res.php in FLIR AX8 devices up to firmware version 1.46.16, allowing attackers to execute arbitrary commands via the value parameter.
What is the CVSS score for CVE-2023-51126?
CVE-2023-51126 has CVSS 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS: 31.1%.
Is CVE-2023-51126 actively exploited?
No confirmed active exploitation of CVE-2023-51126 as of 2026-05-30.
How do I remediate CVE-2023-51126?
Priority: IMMEDIATE.
What systems are affected by CVE-2023-51126?
CVE-2023-51126 affects: Flir, Flir.
Vulnerability Details
CVE IDCVE-2023-51126
BSIDBS-2024-GLOBAL-053051-C BreachSpider Global ID
CVSS VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Published2024-01-10
Last Modified2025-10-17
ICS Relevance15%
Weakness (CWE)
Command Injection
SourceNVD
Official Description

Command injection vulnerability in /usr/www/res.php in FLIR AX8 up to 1.46.16 allows attackers to run arbitrary commands via the value parameter. NOTE: The vendor has stated that with the introduction of firmware version 1.49.16 (Jan 2023) the FLIR AX8 should no longer be affected by the vulnerability reported. Latest firmware version (as of Oct 2025, was released Jun 2024) is 1.55.16.

Source: NIST NVD / MITRE CVE Database

Attack Vector Analysis — CITED Relevance

The vulnerability is exploited by sending a specially crafted request to the /usr/www/res.php endpoint with a malicious value parameter, which is not properly sanitized by the application. This allows the attacker to inject and execute arbitrary commands on the device.

Exploitation Likelihood: HIGH

Affected Products
VendorProductFixed Version
Flir Flir Ax8 Firmware —
Flir Flir Ax8 —
Remediation

No patch URL on record. Monitor vendor security advisories directly.

Threat Intelligence
● Threat Intelligence Validated: July 2026 | Threat Age: 927 Days
CISA KEVNot in KEV catalog
Public ExploitNot confirmed
PoC CodeNot confirmed
SAGE Enrichment Record — provenance & audit hash
Model/workspace/models/qwen2.5-coder-32b-instruct-bf16
ConfidenceHIGH
Enriched At2026-05-24
SHA-512 Audit Hasha65a6306d6ba76b30806186cd6a137e89dad90ee9b2e4510fa3f3f43ad64362914a516033d5e97f5ed2340903ca5eaff5600e315812a56f5bb574a2a83223efd
Related CVEs affecting Flir
CVE-2022-4364 9.8 A vulnerability has been found in Teledyne FLIR AX8 up to 1.46.16. Affected b... CVE-2023-29861 9.8 An issue found in FLIR-DVTEL version not specified allows a remote attacker t... CVE-2022-37061 9.8 All FLIR AX8 thermal sensor cameras version up to and including 1.46.16 are v... CVE-2018-3813 9.8 getConfigExportFile.cgi on FLIR Brickstream 2300 devices 2.0 4.1.53.166 has I... CVE-2025-6266 9.8 A vulnerability was detected in Teledyne FLIR AX8 up to 1.46. Affected by thi...
View all Flir CVEs →

Critical Severity - Know Your Exposure

A CVSS 9.8 vulnerability in your ICS environment cannot wait. BreachSpider maps critical CVEs to your specific assets and tells you what to fix first.

Check Your Assets Free →