← Advisories

FLIR Systems FLIR AX8 Thermal Camera 1.32.16 RTSP Stream Disclosure

Medium
Advisory ID
ZSL-2018-5492
Release Date
14 October 2018
Vendor
FLIR Systems, Inc. - https://www.flir.com
Affected Version
Firmware: 1.32.16, 1.17.13, OS: neco_v1.8-0-g7ffe5b3, Hardware: Flir Systems Neco Board
Tested On
GNU/Linux 3.0.35-flir+gfd883a0 (armv7l), lighttpd/1.4.33, PHP/5.4.14
Summary

Thermal Imaging Camera For Continuous Condition and Safety Monitoring FLIR AX8 is a thermal sensor with imaging capabilities. Combining thermal and visual cameras in a small, affordable package, the AX8 provides continuous temperature monitoring and alarming capabilities to protec critical electrical and mechanical equipment. The AX8 helps you guard against unplanned outages, service interruptions, and equipment failure.

The FLIR AX series camera/sensor also has built-in support to connect to industrial control equipment such as programmable logic controllers (PLCs), and allows the sharing of analysis and alarm results and simple control using the Ethernet/IP and Modbus TCP field bus protocols. Compact and easy to install, the AX8 provides continuous monitoring of electrical cabinets, process and manufacturing areas, data centers, energy generation and distribution, transportation and mass transit, storage facilities and refrigeration warehouses.

Description

The FLIR AX8 thermal sensor camera suffers an unauthenticated and unauthorized live RTSP video stream access.

Proof of Concept
Disclosure Timeline
26.07.2018Vulnerability discovered.
17.08.2018Vendor contacted.
17.08.2018Vendor replied forwarding message to appropriate team.
21.08.2018Vendor responds asking more details.
22.08.2018Replied to the vendor requesting PGP key.
23.08.2018Vendor sends PGP key.
27.08.2018Sent details to the vendor.
29.08.2018Vendor confirms the issues developing patches.
29.08.2018Working with the vendor.
10.10.2018Vendor updating folowing cyber security guide.
14.10.2018Coordinated public security advisory released.
Credits
Vulnerability discovered by Gjoko Krstic
References
Changelog
14.10.2018Initial release