CVE-2023-46295

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.9% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-05-01 · updated 2026-06-17
Weakness: CWE-918

Description

An issue was discovered in Teledyne FLIR M300 2.00-19. Unauthenticated remote code execution can occur in the web server. An attacker can exploit this by sending a POST request to the vulnerable PHP page. An attacker can elevate to root permissions with Sudo.

Affected products

Teledyne Flir M300: from 2.00-19 before 2.00-38 — fixed in 2.00-38

How to fix

Upgrade to a fixed version: Teledyne Flir M300 2.00-38. Check the vendor advisory for mitigations.

References

https://gitlab.com/loudmouth-security/vulnerability-disclosures/cve-2023-46295
https://gitlab.com/loudmouth-security/vulnerability-disclosures/cve-2023-46295

Get alerted when CVE-2023-46295 or the next vulnerability affects your stack