Executive Summary

This vulnerability involves FLIR Thermal Camera models from the F/FC/PT/D series containing hard-coded SSH credentials embedded within their Linux-based firmware. These credentials are permanently set by the manufacturer and cannot be changed or removed through any standard camera operation or user interface. Because of this, attackers can use these persistent credentials to gain unauthorized remote SSH access to the camera system. [1, 2, 3]

Useful 0 Not Useful 0

Impact Analysis

Exploiting this vulnerability allows remote attackers to gain unauthorized root-level SSH access to the affected FLIR thermal cameras. This means attackers can take full control of the device, potentially compromising the camera's data, surveillance capabilities, and overall security. Such unauthorized access poses a high security risk, especially in environments relying on these cameras for monitoring and security. [1, 2, 3]

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by scanning for devices running the affected FLIR Thermal Camera firmware versions (such as 8.0.0.64) and attempting to connect via SSH using the known hard-coded credentials. The known usernames and passwords include root with password "indigo", root with password "video", default with password "video", default with a blank password, and ftp with password "video". You can use SSH client commands to test these credentials against the IP addresses of suspected FLIR cameras on your network. For example, using a command like `ssh root@<camera_ip>` and trying the passwords mentioned. Additionally, network scanning tools can be used to identify devices running SSH on typical FLIR camera ports and then attempt authentication with these credentials to confirm vulnerability. [1, 2, 3]

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include isolating the affected FLIR Thermal Cameras from untrusted networks to prevent unauthorized remote access. Since the hard-coded SSH credentials cannot be changed through normal camera operations, restricting network access via firewall rules or network segmentation is critical. Monitoring and logging SSH access attempts can help detect exploitation attempts. If possible, contact FLIR for firmware updates or patches that address this issue or consider replacing affected devices with models that do not contain hard-coded credentials. [1, 3]

Useful 0 Not Useful 0