CVE-2023-51127: High Directory Traversal in FLIR AX8 Cameras

CVE-2023-51127 is a high severity (CVSS 7.5) directory traversal in FLIR AX8 thermal cameras up to firmware 1.46.16. An unauthenticated attacker can read sensitive files. The vendor states firmware 1.49.16 and later should no longer be affected, so update to the latest release, listed as 1.55.16.

What's affected

The NVD description says FLIR AX8 thermal sensor cameras up to and including 1.46.16 are vulnerable to directory traversal due to improper access restriction, allowing an unauthenticated remote attacker to obtain arbitrary sensitive file contents by uploading a specially crafted symbolic link file.

The record carries a vendor note: with firmware 1.49.16 (January 2023) the FLIR AX8 should no longer be affected, and the latest firmware as of October 2025 is 1.55.16 (released June 2024). The vendor note and the record's affected range (up to 1.46.16) agree, so the fix is firmware 1.49.16 or newer.

The only reference is a researcher repository on GitHub, which I did not load.

CVSS for this entry is 7.5 (High) with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N.

How to check if you're exposed

Read the firmware version in the camera's web interface. At or below 1.46.16 matches the record. At 1.49.16 or later, the vendor says the camera should no longer be affected.

Then confirm whether the interface is reachable from outside the network.

What to do now

1. Inventory AX8 cameras and firmware.
2. Update to 1.49.16 or later, preferably the latest firmware.
3. Remove any exposure of the camera web service to the internet.
4. Rotate credentials or secrets that could be stored in files on the device if you suspect exposure.
5. Run the free in-browser dependency scan at gold.safeguard.sh/scan against your manifests, and look the entry up in the Safeguard Gold directory to see how it is tracked.

Why it matters

CWE-22 is path traversal. File paths built from input can point outside the directory the application meant to expose. The fix is to resolve the final path and confirm it stays inside the permitted directory.

CWE-22 is path traversal, where a file path built from input can point outside the intended directory. Here the record describes it through a symbolic link, which makes the camera follow a path into places it should not serve. The NVD vector shows a confidentiality impact only.

This CVE comes from the same disclosure as CVE-2023-51126, and the same firmware update addresses both per the vendor's note.

The record does not mark this CVE as listed in the CISA Known Exploited Vulnerabilities catalog, and no source I read reports exploitation in the wild.

Quick check

Sources

• Researcher repository listed in the NVD record

Last reviewed: 19 October 2026.