CVE-2017-20215

FLIR Thermal Camera FC-S/PT firmware version 8.0.0.64 contains an authenticated OS command injection vulnerability that allows attackers to execute shell commands with root privileges. Authenticated attackers can inject arbitrary shell commands through unvalidated input parameters to gain complete control of the thermal camera system.

CVSS v4.0

8.7 HIGHCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

CVSS v3.1

8.8 HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS

14.53% chance of exploitation in the next 30 days, 96th percentile

Published

2026-01-07

Updated

2026-04-07

Proof-of-concept exploits (2)

• https://www.exploit-db.com/exploits/42788/
• https://packetstormsecurity.com/files/144325

References

• CVE Record
• NVD entry

Related

• CVE-2017-20214
• CVE-2017-20216
• CVE-2017-20213
• CVE-2017-20217
• CVE-2017-20212
• CVE-2017-20218