cbcvebase.
CVE-2025-6266
published 2025-06-19

CVE-2025-6266: A vulnerability was detected in Teledyne FLIR AX8 up to 1.46. Affected by this vulnerability is an unknown functionality of the file /upload.php. Performing…

PriorityP357critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
0.40%
32.1th percentile
A vulnerability was detected in Teledyne FLIR AX8 up to 1.46. Affected by this vulnerability is an unknown functionality of the file /upload.php. Performing manipulation of the argument File results in unrestricted upload. It is possible to initiate the attack remotely. The exploit is now public and may be used. Upgrading to version 1.49.16 addresses this issue. Upgrading the affected component is recommended. The vendor points out: "FLIR AX8 internal web site has been refactored to be able to handle the reported vulnerabilities."

Affected

48 ranges· showing 25
VendorProductVersion rangeFixed in
flirflir_ax8_firmware< 1.49.161.49.16
teledyne_flirax8——
teledyne_flirax8——
teledyne_flirax8——
teledyne_flirax8——
teledyne_flirax8——
teledyne_flirax8——
teledyne_flirax8——
teledyne_flirax8——
teledyne_flirax8——
teledyne_flirax8——
teledyne_flirax8——
teledyne_flirax8——
teledyne_flirax8——
teledyne_flirax8——
teledyne_flirax8——
teledyne_flirax8——
teledyne_flirax8——
teledyne_flirax8——
teledyne_flirax8——
teledyne_flirax8——
teledyne_flirax8——
teledyne_flirax8——
teledyne_flirax8——
teledyne_flirax8——

CVSS provenance

nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv4.02.1LOWCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
nvdv2.06.5MEDIUMAV:N/AC:L/Au:S/C:P/I:P/A:P
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.