CVE-2018-25141

FLIR Thermal Traffic Cameras V1.01-0bb5b27 Unauthenticated RTSP Stream Disclosure

CVSS 8.7 HIGHEPSS 0.4%CWE-306

Vexday Risk Score

21Low

SSVC decision (CISA)

Track

No exploitation signal → monitor

CVSS 8.7EPSS 0.4%KEV nãoPoC —Nuclei —Metasploit —Patch —

Lifecycle

24 Dec 2025Published on NVD

Recommendation: Monitor — no exploitation signal at the moment.

FLIR thermal traffic cameras contain an unauthenticated vulnerability that allows remote attackers to access live video streams without credentials. Attackers can directly retrieve video streams by accessing specific endpoints like /live.mjpeg, /snapshot.jpg, and RTSP streaming URLs without authentication.

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Affected products

FLIR · FLIR Thermal Traffic Cameras

References

https://www.exploit-db.com/exploits/45537 https://www.flir.com https://www.zeroscience.mk/en/vulnerabilities/ZSL-2018-5489.php