Unauthenticated Access in FLIR AX8 Thermal Camera
CVE-2018-25139

8.7HIGH

Key Information:

Vendor

Flir Systems, Inc.

Status
Flir Ax8 Thermal Camera
Vendor
CVE Published:
24 December 2025

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2018-25139?

The FLIR AX8 Thermal Camera version 1.32.16 is susceptible to an unauthenticated access vulnerability, permitting remote attackers to gain unauthorized access to live video streams. By exploiting this flaw, adversaries can connect to the RTSP (Real-Time Streaming Protocol) stream utilizing common tools such as VLC or FFmpeg, enabling them to view and record footage from the thermal camera without any authentication. This poses a significant risk to the privacy and security of sensitive monitoring operations.

Affected Version(s)

FLIR AX8 Thermal Camera 1.32.16

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2018-25139 - Proof of Concept

References

https://www.exploit-db.com/exploits/45606
exploit
https://www.flir.com
product
https://www.zeroscience.mk/en/vulnerabilities/ZSL-2018-54...
third-party-advisory

CVSS V4

Score:
8.7
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

LiquidWorm as Gjoko Krstic of Zero Science Lab
JSON
.
CVE-2018-25139 : Unauthenticated Access in FLIR AX8 Thermal Camera