CVE-2017-20213
Unauthenticated Access to FLIR Thermal Camera Live Streams
Publication date: 2026-01-08
Last updated on: 2026-01-08
Assigner: VulnCheck
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| flir_systems | flir_thermal_camera_f_fc_pt_d | 8.0.0.64 |
| flir_systems | flir_thermal_camera_f_fc_pt_d | 10.0.2.43 |
| flir_systems | flir_thermal_camera_f_fc_pt_d | From 1.3.2 (inc) to 1.4.1 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-306 | The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability affects FLIR Thermal Camera F/FC/PT/D series running firmware version 8.0.0.64 and certain software versions. It allows remote attackers to access live thermal and visible-light camera video streams without any authentication by directly requesting specific URLs. This means unauthorized users can view live camera feeds without needing credentials, exposing sensitive surveillance data. [1, 3, 4]
How can this vulnerability impact me? :
The vulnerability can lead to unauthorized access to live video streams from FLIR thermal cameras, potentially exposing sensitive thermal and visible-light surveillance footage. This unauthorized disclosure can compromise privacy and security by allowing attackers to monitor areas without permission, which could be exploited for espionage, intrusion planning, or other malicious activities. [1, 3, 4]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by attempting to access the live video stream URLs of the FLIR Thermal Cameras without authentication. For example, you can use commands like curl or wget to request the following URLs on the target device: http://TARGET:8081/graphics/livevideo/stream/stream3.jpg or http://TARGET:8081/graphics/livevideo/stream/stream1.jpg. If these URLs return live video stream images without requiring credentials, the system is vulnerable. [1, 4]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include deploying the affected FLIR thermal cameras only on closed, secured networks to limit unauthorized access. Additionally, apply the firmware patches released by FLIR (Security Patch v1.1) for the affected camera series as soon as possible. Customers should follow FLIR's setup instructions for the patch and consider contacting FLIR support to receive updates and information about software patches. [2]