What is CVE-2017-20216?

CVE-2017-20216 is a critical-severity vulnerability in Flir Systems, Inc. Thermal Camera Pt-Series, classified under OS Command Injection. CVSS score: 9.8/10. Published 2026-01-08.

How severe is CVE-2017-20216?

Critical severity. CVSS v3 base score is 9.8 out of 10.

RCE in Flir Systems, Inc. Thermal Camera Pt-Series

CVE-2017-20216

FLIR Thermal Camera PT-Series firmware version 8.0.0.64 contains multiple unauthenticated remote command injection vulnerabilities in the controllerFlirSystem.php script. Attackers can execute arbitrary system commands as root by exploiting unsanitized POST parameters in the execFlirSystem() function through shell_exec() calls. Exploitation evidence was observed by the Shadowserver Foundation on 2026-01-06 (UTC).

Vulnerability class: Command Injection (OS Command Injection)

EPSS: 0.106 (95.3th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.

Affected products

Flir Systems, Inc. Thermal Camera Pt-series — versions 8.0.0.64

Weakness classification (CWE)

CWE-78 — OS Command Injection

References

disclosure@vulncheck.com (third-party-advisory)
disclosure@vulncheck.com (exploit)
disclosure@vulncheck.com (exploit)
disclosure@vulncheck.com (third-party-advisory)
disclosure@vulncheck.com (vendor-advisory, patch)

Frequently asked questions

What is CVE-2017-20216?: CVE-2017-20216 is a critical-severity vulnerability in Flir Systems, Inc. Thermal Camera Pt-Series, classified under OS Command Injection. CVSS score: 9.8/10. Published 2026-01-08.
How severe is CVE-2017-20216?: Critical severity. CVSS v3 base score is 9.8 out of 10.