CVE-2024-3013 is a Medium severity (CVSS 6.3) improper authorization flaw in the Teledyne FLIR AX8 thermal camera, in firmware up to 1.46.16. A registration function in the web interface can be abused remotely. The record says upgrading to 1.49.16 resolves it, so upgrade and keep the camera off untrusted networks.
What's affected
The record lists Teledyne FLIR AX8 firmware up to 1.46.16. The impacted element is an unknown function of /tools/test_login.php with the register action, in the User Registration component. The weaknesses are CWE-266 and CWE-285, which cover improper privilege management and improper authorization.
The CVSS 3.1 vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L. The attack runs over the network with low privileges, and the impact on confidentiality, integrity and availability is rated low for each. The score of 6.3 falls in the Medium band.
The record states that upgrading to version 1.49.16 is sufficient to resolve the issue. It also quotes the vendor, who said the AX8 internal web site "has been refactored to be able to handle the reported vulnerabilities." Here the record's fixed version is the vendor's own statement, so confirm it against the current Teledyne FLIR firmware notes for your hardware.
How to check if you're exposed
Open the camera's web interface and read the firmware version from the system or about page. Anything at or below 1.46.16 is in the stated range, and 1.49.16 is the version the record names as the fix.
Then check how the camera is reached. From a machine outside your network, test whether the camera's web port answers on your public address:
nmap -Pn -p 80,443 YOUR_PUBLIC_IP
If the camera answers from the internet, fix that first. Cameras of this type are usually meant to sit on an isolated monitoring network.
What to do now
- Upgrade AX8 firmware to 1.49.16 or later, following the vendor's update steps.
- Put the camera on a segmented network with no direct internet exposure.
- Review the camera's user list and remove any accounts you did not create.
- Change default and shared passwords on the device.
- Add the camera to your asset inventory with its firmware version, so the next advisory is easy to match.
Why it matters
The flaw lets someone with low privileges register users in the background, which turns a limited foothold into something more durable. Test and setup pages left in production firmware are a common source of authorization bugs, because they were never designed to face an attacker.
The record does not list this CVE as exploited in the wild, and it carries no CISA Known Exploited Vulnerabilities flag. It does say a public write-up exists. Embedded devices tend to stay unpatched for years, so an asset list with firmware versions is the cheapest defense.
The Gold page for CVE-2024-3013 tracks the entry.
Quick check
Which version fixes it?
The record says upgrading to 1.49.16 resolves the issue. Confirm against the vendor firmware notes for your model.
Do I need to be on the same network?
The vector says the attack runs over the network, so any network path to the camera matters. Keeping it off the internet is the first step.
Sources
Last reviewed: 19 October 2026.
