CVE-2025-6266 is a medium severity (CVSS 6.3) unrestricted file upload (CWE-434) in the upload.php page of Teledyne FLIR AX8 thermal cameras running firmware up to 1.46. The record says upgrading to firmware 1.49.16 addresses the issue.
What's affected
The record covers the Teledyne FLIR AX8 and its firmware up to version 1.46. It states that upgrading to 1.49.16 addresses the issue, and quotes the vendor as saying that the AX8 internal web site "has been refactored to be able to handle the reported vulnerabilities."
The affected file is /upload.php, the page used for firmware updates. A public write up by the reporter describes uploading a crafted archive that the device unpacks, which can lead to arbitrary files or command execution. The record says an exploit is public. The CVSS vector needs a low privilege account and a network route. The record does not mark it as CISA Known Exploited.
How to check if you're exposed
Read the firmware version from the camera web interface or from the vendor tool you use to manage it, and compare it with 1.46 and 1.49.16.
Then find out who can reach the camera. Thermal cameras are often installed on flat networks in plants and buildings. Check three things:
- Whether the web interface is reachable from the internet. Test only addresses you own.
- Which internal networks and VLANs can open the camera web page.
- Which accounts exist on the device, and whether default passwords were changed.
If you manage many cameras, export an inventory with model, firmware version and network location, so you can see every device still below 1.49.16.
What to do now
- Upgrade every AX8 to firmware 1.49.16 or later, following the vendor update steps.
- Remove the web interface from the internet. Reach it only through a VPN or a management network.
- Change default credentials and remove accounts nobody uses.
- Restrict which hosts can talk to the camera with firewall rules, since the upload page is the target.
- After updating, confirm the version in the interface and record it in your asset list.
Why it matters
The weakness is that an upload feature accepted content it should have restricted, and the device then handled that content in a way that could place files or run commands. CWE-434 covers unrestricted upload of dangerous file types, and CWE-284 covers improper access control.
Firmware update pages are a high value target for this class of bug, because their whole job is to accept a file and make the device act on it. Safe designs check who is allowed to upload, verify a signature on the update package, and unpack it in a confined location.
The record says the exploit is public. That raises the odds of scanning, though it is different from the KEV listing, which this CVE does not have.
Quick check
Is CVE-2025-6266 critical?
No. The record scores it 6.3 Medium. It needs a low privilege account. Even so, a public exploit and cameras that sit on exposed networks make the update worth doing promptly.
What is the fixed version?
The record says upgrading to firmware 1.49.16 addresses the issue. Confirm with the vendor release notes for your hardware.
Sources
Last reviewed: 18 October 2026.
