← Advisories

FLIR Systems FLIR Brickstream 3D+ Unauthenticated Config Download File Disclosure

High
Advisory ID
ZSL-2018-5495
Release Date
14 October 2018
Vendor
FLIR Systems, Inc. - https://www.flir.com
Affected Version
Firmware: 2.1.742.1842, Api: 1.0.0, Node: 0.10.33, Onvif: 0.1.1.47
Tested On
Titan, Api/1.0.0
Summary

Thermal Imaging Camera For Continuous Condition and Safety Monitoring FLIR AX8 is a thermal sensor with imaging capabilities. Combining thermal and visual cameras in a small, affordable package, the AX8 provides continuous temperature monitoring and alarming capabilities to protec critical electrical and mechanical equipment. The AX8 helps you guard against unplanned outages, service interruptions, and equipment failure.

The FLIR AX series camera/sensor also has built-in support to connect to industrial control equipment such as programmable logic controllers (PLCs), and allows the sharing of analysis and alarm results and simple control using the Ethernet/IP and Modbus TCP field bus protocols. Compact and easy to install, the AX8 provides continuous monitoring of electrical cabinets, process and manufacturing areas, data centers, energy generation and distribution, transportation and mass transit, storage facilities and refrigeration warehouses.

Description

The FLIR Brickstream 3D+ sensor is vulnerable to unauthenticated config download and file disclosure vulnerability when calling the ExportConfig REST API (getConfigExportFile.cgi). This will enable the attacker to disclose sensitive information and help her in authentication bypass, privilege escalation and/or full system access.

Proof of Concept
Disclosure Timeline
26.07.2018Vulnerability discovered.
17.08.2018Vendor contacted.
17.08.2018Vendor replied forwarding message to appropriate team.
21.08.2018Vendor responds asking more details.
22.08.2018Replied to the vendor requesting PGP key.
23.08.2018Vendor sends PGP key.
27.08.2018Sent details to the vendor.
29.08.2018Vendor confirms the issues developing patches.
29.08.2018Working with the vendor.
10.10.2018Vendor updating folowing cyber security guide.
14.10.2018Coordinated public security advisory released.
Credits
Vulnerability discovered by Gjoko Krstic
References
Changelog
14.10.2018Initial release
15.10.2018Added reference [4] and [5]
17.10.2018Added reference [6]
22.03.2026Added reference [7]