CVE-2024-3013: FLIR AX8 Auth Bypass Vulnerability

CVE-2024-3013 is an authentication bypass vulnerability in Teledyne FLIR AX8 Firmware affecting versions up to 1.46.16. Attackers can exploit improper authorization in the user registration component. This article covers technical details, affected versions, impact assessment, and available patches.

CVE-2024-3013 Overview

CVE-2024-3013 is an improper authorization flaw in Teledyne FLIR AX8 fixed thermal cameras through firmware version 1.46.16. The weakness resides in the /tools/test_login.php?action=register endpoint of the User Registration component. A remote attacker with low privileges can manipulate the request to register arbitrary accounts on the device. The vendor refactored the FLIR AX8 internal web site to address the issue, and firmware 1.49.16 resolves the vulnerability. The flaw is tracked under [CWE-266] Incorrect Privilege Assignment.

Critical Impact
Remote attackers can create unauthorized user accounts on FLIR AX8 thermal cameras, gaining persistent access to a monitoring device deployed in industrial and critical-infrastructure environments.

Affected Products

Teledyne FLIR AX8 firmware versions up to and including 1.46.16
Teledyne FLIR AX8 fixed thermal camera hardware
Deployments using the built-in web management interface

Discovery Timeline

2024-03-28 - CVE-2024-3013 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-3013

Vulnerability Analysis

The FLIR AX8 web interface exposes /tools/test_login.php with a register action that fails to enforce proper authorization checks. An authenticated attacker with low-privilege credentials can invoke the endpoint to register a new user in the background without administrator approval. Because the endpoint reuses a testing pathway rather than the sanctioned registration workflow, role and permission validation is bypassed. The vendor characterized the fix as a refactoring of the internal web site, indicating that the affected path was not intended to be exposed for privileged account creation.

Root Cause

The root cause is Incorrect Privilege Assignment [CWE-266] in the test_login.php handler. The action=register branch performs account creation without validating whether the caller holds an administrative role. This design flaw allows any authenticated session to escalate its footprint on the device by minting additional accounts.

Attack Vector

Exploitation is performed remotely over the network against the camera's web interface. The attacker requires low privileges to reach the endpoint and issues a crafted HTTP request to /tools/test_login.php?action=register supplying attacker-controlled credentials. A public technical write-up describes the exact request structure. See the GitHub FLIR AX8 Vulnerability Report and the VulDB entry #258299 for additional detail.

No verified proof-of-concept code is reproduced here. Refer to the linked advisories for the exact request payload.

Detection Methods for CVE-2024-3013

Indicators of Compromise

HTTP requests to /tools/test_login.php containing the query parameter action=register from any remote source.
Newly created FLIR AX8 user accounts that do not correspond to a legitimate administrator action or change ticket.
Successful authentications from unexpected source addresses following registration activity on the device.

Detection Strategies

Inspect web server and reverse-proxy logs fronting FLIR AX8 devices for the test_login.php?action=register URI pattern.
Alert on any HTTP POST or GET to the /tools/ directory of the camera web interface originating outside a defined management VLAN.
Baseline the number of accounts on each camera and flag deviations during periodic configuration audits.

Monitoring Recommendations

Forward FLIR AX8 access logs to a centralized logging platform for correlation with authentication events.
Monitor network flows to camera management ports (HTTP/HTTPS) and alert on connections from non-administrative hosts.
Track firmware version inventory to ensure all AX8 devices are running 1.49.16 or later.

How to Mitigate CVE-2024-3013

Immediate Actions Required

Upgrade all Teledyne FLIR AX8 devices to firmware version 1.49.16 or later.
Restrict network access to the AX8 web management interface using firewall rules or a dedicated management VLAN.
Audit existing user accounts on each camera and remove any accounts that cannot be attributed to authorized administrators.
Rotate credentials for all remaining accounts after patching.

Patch Information

Teledyne FLIR has released firmware version 1.49.16, which refactors the internal web site to remove the vulnerable test_login.php behavior. Upgrading the affected component resolves CVE-2024-3013. Refer to the VulDB advisory #258299 for vendor references and the VulDB submission record for disclosure context.

Workarounds

Place FLIR AX8 cameras behind a network segment that blocks direct Internet access to the web interface.
Enforce ACLs that allow the camera management interface to be reached only from authorized administrator workstations.
Where feasible, disable the web interface when not required for active configuration or monitoring.

bash

# Example iptables rule restricting AX8 web access to a management subnet
iptables -A FORWARD -p tcp -d <FLIR_AX8_IP> --dport 80  -s 10.10.50.0/24 -j ACCEPT
iptables -A FORWARD -p tcp -d <FLIR_AX8_IP> --dport 443 -s 10.10.50.0/24 -j ACCEPT
iptables -A FORWARD -p tcp -d <FLIR_AX8_IP> --dport 80  -j DROP
iptables -A FORWARD -p tcp -d <FLIR_AX8_IP> --dport 443 -j DROP