CVE-2026-14984
CriticalCVSS 9.4Summary
Teledyne FLIR Aware2 versions through 6.9.0.2 transmit data in cleartext in primary control endpoints. Remote unauthenticated attackers can intercept, hijack, or modify session traffic against PackBot robots via sniffing or hijacking network traffic.
Risk Assessment
Interception and modification of traffic can lead to confidentiality and integrity breaches and potential control takeover of robots.
Recommendation
Update to the latest version and implement encryption (e.g., TLS) for all control channels.
Other vulnerabilities in Teledyne FLIR Aware2
See all- CVE-2026-55396High
Cleartext transmission without a cryptographic integrity check in operator control unit to robot UDP traffic in Teledyne FLIR Aware2 versions through 6.9.0.2 (PackBot) and 1.7.9 (FirstLook) allows adjacent unauthenticated attackers to intercept, hijack, or modify control traffic against Teledyne FLIR PackBot and FirstLook robots running this software via sniffing or hijacking network traffic.
- CVE-2026-55394Medium
Unencrypted traffic in the 802.11 network of Teledyne FLIR Aware2 versions through 6.9.0.2 allows adjacent unauthenticated attackers to intercept, hijack, or modify session traffic against Teledyne FLIR PackBot robots running this software via sniffing or hijacking network traffic.
- CVE-2026-14983High
Missing authentication in the web interface in Teledyne FLIR Aware2 versions through 6.9.0.2 allows remote unauthenticated attackers to achieve denial of service against Teledyne FLIR PackBot robots running this software via misuse of the reboot endpoint.
- CVE-2026-55395Critical
Teledyne FLIR Aware2 versions through 6.9.0.2 (PackBot) and 1.7.9 (FirstLook) contain hardcoded passwords in access control. Remote unauthenticated attackers can read them from firmware or documentation and access/reconfigure the robots.
- CVE-2026-55393Critical
Teledyne FLIR Aware2 versions through 6.9.0.2 (PackBot) and 1.7.9 (FirstLook) have unvalidated pathnames in the web interface. Remote unauthenticated attackers can use path traversal to read configuration and security parameters.
Original NVD description (English source)
Cleartext transmission in the primary control endpoints of Teledyne FLIR Aware2 versions through 6.9.0.2 allows remote unauthenticated attackers to intercept, hijack, or modify session traffic against Teledyne FLIR PackBot robots running this software via sniffing or hijacking network traffic.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS