CVE-2023-51127 Path traversal in n/a

High 7.5 Published 10 Jan 2024 Updated 17 Oct 2025

Unauthenticated attackers can read arbitrary sensitive files on FLIR AX8 thermal cameras by uploading a crafted symbolic link.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2023-51127?

CVE-2023-51127 is a high-severity path traversal vulnerability in n/a, published on 10 Jan 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

FLIR AX8 thermal sensor cameras up to and including 1.46.16 are vulnerable to Directory Traversal due to improper access restriction. This vulnerability allows an unauthenticated, remote attacker to obtain arbitrary sensitive file contents by uploading a specially crafted symbolic link file. NOTE: The vendor has stated that with the introduction of firmware version 1.49.16 (Jan 2023) the FLIR AX8 should no longer be affected by the vulnerability reported. Latest firmware version (as of Oct 2025, was released Jun 2024) is 1.55.16.

Weakness: CWE-22

Which versions are affected by CVE-2023-51127?

It affects 1 product.

Products include Flir Flir Ax8 Firmware.

How do I fix CVE-2023-51127?

No fix has been published for CVE-2023-51127 yet. Limit exposure of the affected software until one is available.

Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.

Is CVE-2023-51127 being exploited?

There is no known exploitation of CVE-2023-51127 in the wild and no public exploit code.

Public exploit code: 1 proofs of concept on GitHub.

Sources

Also known as GHSA-823h-79qw-hp52.