CVE-2024-3013 is a critical improper authorization vulnerability affecting Teledyne FLIR AX8 devices running firmware versions up to 1.46.16. Specifically, an unknown function within the /tools/test_login.php?action=register component allows for unauthorized user registration. This vulnerability carries a CVSS score of 8.8 (High), indicating that it can be exploited remotely with low complexity, potentially leading to high impact on confidentiality, integrity, and availability. The vendor has released a fix in version 1.49.16, which refactors the internal web site to address this and other reported vulnerabilities. While an exploit has been published, there is currently no evidence of active exploitation, Metasploit modules, or Nuclei templates. Community discussion and media coverage are minimal, suggesting a low level of public awareness despite the published exploit.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
>= 1.46.0, <= 1.46.16CPE matchmatch criteria | cpe:2.3:o:flir:flir_ax8_firmware:*:*:*:*:*:*:*:* |
CVSS version used by this source: 4.0
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
No social media mentions found for this CVE.
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.3 Bluesky, 0.1 Mastodon, and 0.2 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.