Login Sign Up

CVE-2022-31208

8.8 HIGH
Remote Code Execution

📋 TL;DR

This vulnerability allows remote command execution on Infiray IRAY-A8Z3 thermal cameras by manipulating the cmd_string URL parameter in the webserver. Attackers can execute arbitrary commands with the privileges of the webserver process. All users of affected Infiray thermal cameras are impacted.

💻 Affected Systems

Products:
  • Infiray IRAY-A8Z3 thermal camera
Versions: Version 1.0.957
Operating Systems: Embedded Linux
Default Config Vulnerable: ⚠️ Yes
Notes: All cameras running the vulnerable firmware version are affected regardless of configuration.

📦 What is this software?

Iray A8z3 Firmware by Infiray

View all CVEs affecting Iray A8z3 Firmware →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Complete compromise of the thermal camera system, allowing attackers to execute arbitrary commands, access sensitive data, pivot to internal networks, or disable security monitoring capabilities.

🟠

Likely Case

Remote code execution leading to camera compromise, data exfiltration, or use as a foothold for further network attacks.

🟢

If Mitigated

Limited impact if cameras are isolated on separate network segments with strict firewall rules and access controls.

🌐 Internet-Facing: HIGH - Directly exploitable via HTTP requests without authentication, making internet-exposed cameras immediate targets.
🏢 Internal Only: HIGH - Even internally, any network-accessible camera can be exploited by attackers who gain internal access.

🎯 Exploit Status

Public PoC: ⚠️ Yes
Weaponized: LIKELY
Unauthenticated Exploit: ⚠️ Yes
Complexity: LOW

Exploitation requires only HTTP access and manipulation of URL parameters. The vulnerability is well-documented in security advisories.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Check with Infiray for updated firmware

Vendor Advisory: https://www.infiray.com/infrared-security-database.html

Restart Required: Yes

Instructions:

1. Check Infiray security database for latest firmware. 2. Download updated firmware from vendor portal. 3. Upload firmware to camera via web interface. 4. Reboot camera after installation.

🔧 Temporary Workarounds

Network Segmentation

all

Isolate thermal cameras on separate VLAN with strict firewall rules

Access Control

linux

Restrict HTTP access to camera management interface to authorized IPs only

iptables -A INPUT -p tcp --dport 80 -s TRUSTED_IP -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j DROP

🧯 If You Can't Patch

  • Segment cameras on isolated network with no internet access
  • Implement strict firewall rules blocking all external access to camera management interfaces

🔍 How to Verify

Check if Vulnerable:

Check firmware version in camera web interface or attempt to access vulnerable endpoint with test payload

Check Version:

Check camera web interface under System > Information or similar menu

Verify Fix Applied:

Verify firmware version is updated and test endpoint no longer accepts arbitrary commands

📡 Detection & Monitoring

Log Indicators:

  • Unusual HTTP requests to camera endpoints
  • Commands containing suspicious parameters like cmd_string
  • Multiple failed login attempts followed by command execution

Network Indicators:

  • HTTP requests with cmd_string parameter to camera IP
  • Unusual outbound connections from camera to external IPs

SIEM Query:

source="camera_logs" AND (url="*cmd_string*" OR method="POST" AND uri="*execute*" OR status=200 AND bytes>100000)

📊 Metadata

CVE ID: CVE-2022-31208
CVSS v3 Score: 8.8 (HIGH)
CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Published: July 17, 2022
Last Updated: November 21, 2024

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON