CVE-2026-55395
CriticalCVSS 9.4Summary
Teledyne FLIR Aware2 versions through 6.9.0.2 (PackBot) and 1.7.9 (FirstLook) contain hardcoded passwords in access control. Remote unauthenticated attackers can read them from firmware or documentation and access/reconfigure the robots.
Risk Assessment
Unauthorized access to robots could lead to full control, altered operations, and compromised safety.
Recommendation
Update to the latest available version and change all default passwords. Restrict access to firmware and documentation.
Other vulnerabilities in Teledyne FLIR Aware2
See all- CVE-2026-55396High
Cleartext transmission without a cryptographic integrity check in operator control unit to robot UDP traffic in Teledyne FLIR Aware2 versions through 6.9.0.2 (PackBot) and 1.7.9 (FirstLook) allows adjacent unauthenticated attackers to intercept, hijack, or modify control traffic against Teledyne FLIR PackBot and FirstLook robots running this software via sniffing or hijacking network traffic.
- CVE-2026-55394Medium
Unencrypted traffic in the 802.11 network of Teledyne FLIR Aware2 versions through 6.9.0.2 allows adjacent unauthenticated attackers to intercept, hijack, or modify session traffic against Teledyne FLIR PackBot robots running this software via sniffing or hijacking network traffic.
- CVE-2026-14983High
Missing authentication in the web interface in Teledyne FLIR Aware2 versions through 6.9.0.2 allows remote unauthenticated attackers to achieve denial of service against Teledyne FLIR PackBot robots running this software via misuse of the reboot endpoint.
- CVE-2026-55393Critical
Teledyne FLIR Aware2 versions through 6.9.0.2 (PackBot) and 1.7.9 (FirstLook) have unvalidated pathnames in the web interface. Remote unauthenticated attackers can use path traversal to read configuration and security parameters.
- CVE-2026-14984Critical
Teledyne FLIR Aware2 versions through 6.9.0.2 transmit data in cleartext in primary control endpoints. Remote unauthenticated attackers can intercept, hijack, or modify session traffic against PackBot robots via sniffing or hijacking network traffic.
Original NVD description (English source)
Hardcoded passwords in the access control in Teledyne FLIR Aware2 versions through 6.9.0.2 (PackBot) and 1.7.9 (FirstLook) allows remote unauthenticated attackers to access and reconfigure Teledyne FLIR PackBot and FirstLook robots running this software via reading the passwords from the firmware or documentation.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS