CVE-2017-20212: FLIR Thermal Camera Info Disclosure Flaw

CVE-2017-20212 Overview

CVE-2017-20212 is a path traversal vulnerability affecting FLIR Thermal Camera F/FC/PT/D firmware version 8.0.0.64. This information disclosure vulnerability allows unauthenticated attackers to read arbitrary files through unverified input parameters. Attackers can exploit the /var/www/data/controllers/api/xml.phpreadFile() function to access local system files without authentication.

Critical Impact

Unauthenticated remote attackers can read sensitive system files from FLIR thermal cameras, potentially exposing configuration data, credentials, and other sensitive information stored on the device.

Affected Products

• FLIR Thermal Camera F-Series (firmware 8.0.0.64)
• FLIR Thermal Camera FC-Series (firmware 8.0.0.64)
• FLIR Thermal Camera PT-Series (firmware 8.0.0.64)
• FLIR Thermal Camera D-Series (firmware 8.0.0.64)

Discovery Timeline

• 2026-01-08 - CVE CVE-2017-20212 published to NVD
• 2026-01-08 - Last updated in NVD database

Technical Details for CVE-2017-20212

Vulnerability Analysis

This vulnerability stems from improper input validation in the FLIR thermal camera's web interface. The readFile() function within the /var/www/data/controllers/api/xml.php endpoint fails to properly sanitize user-supplied input, allowing attackers to traverse the file system using path manipulation techniques.

The vulnerability is classified under CWE-22 (Path Traversal), which occurs when software uses external input to construct a pathname that should be restricted to a limited directory, but fails to neutralize sequences like ../ that can resolve to a location outside of that directory.

Since this is an IoT/embedded device vulnerability affecting firmware on network-accessible thermal cameras, successful exploitation could expose sensitive configuration files, authentication credentials, or system information that could be leveraged for further attacks against the device or connected infrastructure.

Root Cause

The root cause of this vulnerability is insufficient input validation in the readFile() function. The PHP endpoint accepts file path parameters from unauthenticated users without properly validating or sanitizing the input to prevent directory traversal sequences. This allows attackers to escape the intended web directory and access arbitrary files readable by the web server process.

Attack Vector

The attack is network-based and requires no authentication or user interaction. An attacker with network access to the vulnerable FLIR camera can craft malicious HTTP requests to the xml.php endpoint, supplying path traversal sequences (such as ../) in the file parameter to access files outside the intended directory. This allows reading sensitive system files including /etc/passwd, configuration files, or any other files accessible to the web server process.

The vulnerability can be exploited by sending specially crafted HTTP requests to the vulnerable PHP endpoint. Technical details and proof-of-concept code are available in the Exploit-DB #42786 and Zero Science Vulnerability ZSL-2017-5434 advisories.

Detection Methods for CVE-2017-20212

Indicators of Compromise

• HTTP requests to /var/www/data/controllers/api/xml.php containing path traversal sequences such as ../ or encoded variants
• Web server logs showing requests attempting to access sensitive files like /etc/passwd or /etc/shadow
• Unusual access patterns targeting the XML API endpoint from external IP addresses
• Failed or successful file read attempts for system configuration files

Detection Strategies

• Monitor web server access logs for requests containing directory traversal patterns targeting the xml.php endpoint
• Deploy network-based intrusion detection rules to identify path traversal attempts in HTTP traffic
• Implement file integrity monitoring on sensitive system files to detect unauthorized access
• Configure web application firewalls to block requests containing path traversal sequences

Monitoring Recommendations

• Enable verbose logging on FLIR camera web interfaces to capture detailed request information
• Segment IoT devices including thermal cameras on isolated network segments with restricted access
• Monitor network traffic to and from thermal camera devices for anomalous patterns
• Implement regular vulnerability scanning of network-connected IoT and embedded devices

How to Mitigate CVE-2017-20212

Immediate Actions Required

• Restrict network access to FLIR thermal cameras to trusted IP addresses and networks only
• Place vulnerable cameras behind a firewall or VPN to prevent direct internet exposure
• Disable or restrict access to the web interface if not required for operations
• Review access logs for evidence of exploitation attempts

Patch Information

FLIR has acknowledged this vulnerability. Refer to the FLIR Security Blog Post for official vendor guidance. Organizations should contact FLIR support for firmware updates that address this vulnerability. Additional technical details are available from CXSecurity Issue WLB-2017090202 and Packet Storm File #144322.

Workarounds

• Implement network segmentation to isolate thermal cameras from untrusted networks
• Configure firewall rules to block external access to the camera's web interface on ports 80 and 443
• Use a reverse proxy with request filtering to block path traversal patterns before they reach the camera
• If possible, disable the XML API endpoint until a patch is available

# Example firewall rule to restrict access to FLIR camera web interface
# Allow access only from trusted management subnet
iptables -A INPUT -p tcp --dport 80 -s 192.168.10.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -s 192.168.10.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j DROP
iptables -A INPUT -p tcp --dport 443 -j DROP