CVE-2023-51126 PoC — Teledyne FLIR AX8 安全漏洞

Source

https://github.com/risuxx/CVE-2023-51126

Associated Vulnerability

Title:Teledyne FLIR AX8 安全漏洞 (CVE-2023-51126)
Description:Command injection vulnerability in /usr/www/res.php in FLIR AX8 up to 1.46.16 allows attackers to run arbitrary commands via the value parameter. NOTE: The vendor has stated that with the introduction of firmware version 1.49.16 (Jan 2023) the FLIR AX8 should no longer be affected by the vulnerability reported. Latest firmware version (as of Oct 2025, was released Jun 2024) is 1.55.16.

Readme

# CVE-2023-51126
FLIR AX8 up to 1.46.16 is vulnerable to command injection via /usr/www/res.php.

### VulnerabilityType Other
command injection

### Vendor of Product
FLIR

### Affected Component
in /usr/www/res.php. The parameter `value` can inject the command and exec it.

### Attack Type
Remote

### Impact Code execution
true

### Reference
https://aux1.preditec.com/

### Discoverer
Lin Xinkang from Wuhan University

This page will be used to disclose information about CVE-2023-51126, and may be updated with the PoC for the exploit later.

File Snapshot


 [4.0K]  /data/pocs/da07998a08f2cb13a54f7c45cf60f86fdea0d668
└── [ 548]  README.md

0 directories, 1 file

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →

Goal Reached Thanks to every supporter — we hit 100%!