CVE-2023-51126 is a critical severity (CVSS 9.8) command injection in /usr/www/res.php on FLIR AX8 thermal cameras running firmware up to 1.46.16. The vendor states firmware 1.49.16 and later should no longer be affected, so update to the latest firmware, which the record lists as 1.55.16.
What's affected
The NVD description says command injection in /usr/www/res.php in FLIR AX8 up to 1.46.16 allows attackers to run arbitrary commands via the value parameter.
The record carries a vendor note: with firmware 1.49.16 (January 2023) the FLIR AX8 should no longer be affected, and the latest firmware as of October 2025 is 1.55.16 (released June 2024). The vendor note and the record's affected range (up to 1.46.16) agree, so the fix is firmware 1.49.16 or newer.
The only reference is a researcher repository on GitHub, which I did not load.
CVSS for this entry is 9.8 (Critical) with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
How to check if you're exposed
Open the camera's web interface and read the firmware version. Anything at or below 1.46.16 is inside the affected range. Anything at 1.49.16 or later is covered by the vendor's note.
Also check whether the camera is reachable from outside the network. The NVD vector needs no privileges and no interaction.
What to do now
- List every FLIR AX8 camera and its firmware version.
- Update cameras to firmware 1.49.16 or newer, ideally the latest release.
- Keep camera management interfaces off the internet and on a segment of their own.
- Change default credentials and review who can reach the cameras.
- Run the free in-browser dependency scan at gold.safeguard.sh/scan against your manifests, and look the entry up in the Safeguard Gold directory to see how it is tracked.
Why it matters
CWE-77 is command injection in a broad sense. Data supplied by a user ends up inside a command that the system then runs. The fix is to keep user data out of command strings and to validate whatever must be passed.
CWE-77 is command injection. A request parameter ends up inside a command that the camera runs. The NVD scores it 9.8 because it is reachable over the network without credentials, with high impact on all three properties.
Industrial and monitoring cameras often remain in service for years without updates, so a fix released in January 2023 may not have reached them. An inventory of device firmware is the first step.
The record does not mark this CVE as listed in the CISA Known Exploited Vulnerabilities catalog, and no source I read reports exploitation in the wild.
Quick check
Which firmware fixes it?
The vendor note in the record says 1.49.16 and later should no longer be affected.
Is it exploited in the wild?
The record's KEV flag is false and no source I read says so.
Sources
Last reviewed: 19 October 2026.
