CVE-2018-25141

FLIR thermal traffic cameras contain an unauthenticated vulnerability that allows remote attackers to access live video streams without credentials. Attackers can directly retrieve video streams by accessing specific endpoints like /live.mjpeg, /snapshot.jpg, and RTSP streaming URLs without authentication.

Score

CVSS 4.0 8.7 High

Status

Deferred - disclosure@vulncheck.com

Published

2025-12-24

Last modified

2026-03-05

Weaknesses

CWE-306

Affected products

• Flir Ax8 Firmware (Flir)

References

• https://www.exploit-db.com/exploits/45537
• https://www.flir.com
• https://www.zeroscience.mk/en/vulnerabilities/ZSL-2018-5489.php