CVE-2017-20215

Published: Jan 8, 2026Modified: Jan 8, 2026

8.7

Vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Show more

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XShow less

Source: disclosure@vulncheck.com (Secondary)

Description

FLIR Thermal Camera FC-S/PT firmware version 8.0.0.64 contains an authenticated OS command injection vulnerability that allows attackers to execute shell commands with root privileges. Authenticated attackers can inject arbitrary shell commands through unvalidated input parameters to gain complete control of the thermal camera system.

Related CWEs

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

References (8)

https://cxsecurity.com/issue/WLB-2017090207

Source: disclosure@vulncheck.com

https://packetstormsecurity.com/files/144325

Source: disclosure@vulncheck.com

https://web.archive.org/web/20171011125811/https://www.flir.com/security/blog/details/?ID=87043

Source: disclosure@vulncheck.com

https://www.exploit-db.com/exploits/42788/

Source: disclosure@vulncheck.com

https://www.zeroscience.mk/en/vulnerabilities/ZSL-2017-5437.php

Source: disclosure@vulncheck.com

https://cxsecurity.com/issue/WLB-2017090207

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

https://www.exploit-db.com/exploits/42788/

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

https://www.zeroscience.mk/en/vulnerabilities/ZSL-2017-5437.php

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

Timeline

No history available yet.