What’s Vulnerable › Vulnerabilities

CVE-2018-25137: FLIR Brickstream 3D+ 2.1.742.1842 Unauthenticated Config File Disclosure

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-12-24 · updated 2026-06-17
• Weakness: CWE-306

Description

FLIR Brickstream 3D+ 2.1.742.1842 contains an unauthenticated vulnerability in the ExportConfig REST API that allows attackers to download sensitive configuration files. Attackers can exploit the getConfigExportFile.cgi endpoint to retrieve system configurations, potentially enabling authentication bypass and privilege escalation.

Affected products

• FLIR Systems, Inc. FLIR Brickstream 3D+: 2.1.742.1842

References

• http://www.brickstream.com
• https://www.exploit-db.com/exploits/45599
• https://www.zeroscience.mk/en/vulnerabilities/ZSL-2018-5495.php
• https://www.zeroscience.mk/en/vulnerabilities/ZSL-2018-5495.php

Get alerted when CVE-2018-25137 or the next vulnerability affects your stack