CVE-2017-20214

9.3 criticalEPSS 0.3%

FLIR Thermal Camera F/FC/PT/D firmware version 8.0.0.64 contains hard-coded SSH credentials that cannot be changed through normal camera operations. Attackers can leverage these persistent, unmodifiable credentials to gain unauthorized remote access to the thermal camera system.

Severity

CVSS 4.0

9.3 critical

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

CVSS 3.1

7.5 high

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS: 0.3% chance of exploitation in the next 30 days; higher than 26% of CVEs (scores of 2026-10-31)
CWE: CWE-798
Published: 2026-01-08
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

References

https://cxsecurity.com/issue/WLB-2017090205
https://packetstormsecurity.com/files/144324
https://web.archive.org/web/20171011125811/https://www.flir.com/security/blog/details/?ID=87043
https://www.exploit-db.com/exploits/42787/
https://www.zeroscience.mk/en/vulnerabilities/ZSL-2017-5436.php

Check your stack JSON