CVE-2026-55394
MediumCVSS 5.3Summary
Unencrypted traffic in the 802.11 network of Teledyne FLIR Aware2 versions through 6.9.0.2 allows adjacent unauthenticated attackers to intercept, hijack, or modify session traffic against Teledyne FLIR PackBot robots running this software via sniffing or hijacking network traffic.
Risk Assessment
An attacker in proximity can intercept or modify communication with PackBot robots, potentially leading to confidentiality and integrity breaches and possibly taking control of the robot.
Recommendation
Update Teledyne FLIR Aware2 to a version newer than 6.9.0.2 if a patch is available, and consider implementing additional encryption and authentication mechanisms in the network.
Other vulnerabilities in Teledyne FLIR Aware2
See all- CVE-2026-55396High
Cleartext transmission without a cryptographic integrity check in operator control unit to robot UDP traffic in Teledyne FLIR Aware2 versions through 6.9.0.2 (PackBot) and 1.7.9 (FirstLook) allows adjacent unauthenticated attackers to intercept, hijack, or modify control traffic against Teledyne FLIR PackBot and FirstLook robots running this software via sniffing or hijacking network traffic.
- CVE-2026-14983High
Missing authentication in the web interface in Teledyne FLIR Aware2 versions through 6.9.0.2 allows remote unauthenticated attackers to achieve denial of service against Teledyne FLIR PackBot robots running this software via misuse of the reboot endpoint.
- CVE-2026-55395Critical
Teledyne FLIR Aware2 versions through 6.9.0.2 (PackBot) and 1.7.9 (FirstLook) contain hardcoded passwords in access control. Remote unauthenticated attackers can read them from firmware or documentation and access/reconfigure the robots.
- CVE-2026-55393Critical
Teledyne FLIR Aware2 versions through 6.9.0.2 (PackBot) and 1.7.9 (FirstLook) have unvalidated pathnames in the web interface. Remote unauthenticated attackers can use path traversal to read configuration and security parameters.
- CVE-2026-14984Critical
Teledyne FLIR Aware2 versions through 6.9.0.2 transmit data in cleartext in primary control endpoints. Remote unauthenticated attackers can intercept, hijack, or modify session traffic against PackBot robots via sniffing or hijacking network traffic.
Original NVD description (English source)
Unencrypted traffic in the 802.11 network of Teledyne FLIR Aware2 versions through 6.9.0.2 allows adjacent unauthenticated attackers to intercept, hijack, or modify session traffic against Teledyne FLIR PackBot robots running this software via sniffing or hijacking network traffic.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS