FLIR Thermal Traffic Cameras Unauthenticated WebSocket Device Manipulation

Vulnerability Key Information Vulnerability Name: FLIR Systems FLIR Thermal Traffic Cameras Websocket Device Manipulation Identification ID: ZSL-2018-5490 Type: Local/Remote Impact: Exposure of System Information, Exposure of Sensitive Information, DoS, Manipulation of Data, Cross-Site Scripting Risk: 5/5 Release Date: 06.10.2018 Vulnerability Description FLIR's thermal traffic cameras are affected by an unauthenticated device manipulation vulnerability exploiting the WebSocket protocol. These devices use an insecure implementation of WebSocket communication, allowing attackers to directly modify runtime configurations, steal information, or trigger DoS scenarios (via Reboot command), thereby leaking network traffic to MitM attackers in plain text. Additionally, the web service is vulnerable to Cross-Site WebSocket Hijacking (CSWSH). Affected Versions V1.01-0bb5b27 - (TrafiOne) - Codename: TrafiOne E1.00.09 - (TI BPL2 EDGE) - Codename: TIP4EDGE V1.02.P01 - (TI x-stream) - Codename: TIP2 V1.05.P01 - (ThermiCam) - Codename: ThermiCam V1.04.P02 - (ThermiCam) - Codename: ThermiCam V1.04 - (ThermiCam) - Codename: ThermiCam V1.01.P02 - (ThermiCam) - Codename: ThermiCam V1.03.P03 - (TrafiSense) - Codename: TrafiSense V1.06 - (VIP-IP) - Codename: VIP-IP V1.02.P02 - (TrafiRadar) - Codename: TrafiRadar Vulnerability Discovery and Remediation [26.07.2018] Vulnerability discovered [06.10.2018] Coordinated public security advisory released

Goal Reached Thanks to every supporter — we hit 100%!

FLIR Thermal Traffic Cameras Unauthenticated WebSocket Device Manipulation