CVE-2022-37063 Cross-site scripting in n/a

What is CVE-2022-37063?

CVE-2022-37063 is a medium-severity cross-site scripting vulnerability in n/a, published on 18 Aug 2022. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.

Official description

All FLIR AX8 thermal sensor cameras versions up to and including 1.46.16 are vulnerable to Cross Site Scripting (XSS) due to improper input sanitization. An authenticated remote attacker can execute arbitrary JavaScript code in the web management interface. A successful exploit could allow the attacker to insert malicious JavaScript code. NOTE: The vendor has stated that with the introduction of firmware version 1.49.16 (Jan 2023) the FLIR AX8 should no longer be affected by the vulnerability reported. Latest firmware version (as of Oct 2025, was released Jun 2024) is 1.55.16.

Weakness: CWE-79

Which versions are affected by CVE-2022-37063?

It affects 1 product.

Products include Flir Flir Ax8 Firmware.

How do I fix CVE-2022-37063?

No fix has been published for CVE-2022-37063 yet. Limit exposure of the affected software until one is available.

Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.

Is CVE-2022-37063 being exploited?

There is no known exploitation of CVE-2022-37063 in the wild and no public exploit code.

Other vulnerabilities in n/a

• CVE-2023-51126 Command injection in n/a Critical 9.8
• CVE-2022-37061 Command injection in n/a Critical 9.8
• CVE-2018-25138 FLIR AX8 Thermal Camera 1.32.16 Hard-Coded Credentials Authentication Bypass Critical 9.3
• CVE-2018-25139 FLIR AX8 Thermal Camera 1.32.16 Unauthenticated RTSP Stream Disclosure High 8.7
• CVE-2025-5126 Teledyne FLIR AX8 settingsregional.php setDataTime command injection High 8.7

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-2j49-6mmc-22jj.