Teledyne FLIR Aware2: Unauthenticated path traversal in web interface
Summary
Unvalidated path names in the web interface of Teledyne FLIR Aware2 allow remote, unauthenticated attackers to read arbitrary files on PackBot and FirstLook robots. Exposed configuration and security parameters can include credentials, and the flaw may be used to escalate privileges and fully compromise the device. The CNA rates the issue CVSS 4.0 10.0 (Critical); NVD analysis was still pending at publication.
Affected
- Teledyne FLIR Aware2 on PackBot up to and including 6.9.0.2
- Teledyne FLIR Aware2 on FirstLook up to and including 1.7.9
Fixed in
- Vendor has released updated software (Mandiant timeline: 2026-09-30). Fixed version numbers: Unknown.
Workaround
- Unknown. No vendor workaround found in the sources.
- Until patched, restrict access to the robot's web interface to the operator network only (generic recommendation, not a vendor instruction).
Exploitation
- No public exploit code confirmed at this time.
- Not listed in the CISA KEV catalog.
- No known in-the-wild exploitation.
- CISA SSVC: Automatable yes, technical impact total.
Our recommendation
- Check whether any PackBot or FirstLook robot runs Aware2 and whether its web interface is reachable from outside the operator network, including via VPN or 4G/5G gateways.
- Isolate affected devices from untrusted networks now.
- Contact Teledyne (UGS-CHELMSFORD-TEAMS-FSE@Teledyne.com) for the updated software and install it.
- Rotate any credentials stored on the device after patching.
- Review related advisories CVE-2026-55395, CVE-2026-55394 and CVE-2026-55396 for the same robot platforms.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Mandiant advisory MNDT-2026-0029 github.com
- Vulners CVE-2026-55393 vulners.com
- Mandiant mirror (imfht) CVE-2026-55393 cve.imfht.com
- Strix CVE-2026-55393 www.strix.ai
- TheHackerWire CVE-2026-55393 www.thehackerwire.com
- OpenCVE CVE-2026-55393 app.opencve.io
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 14:43.
Original description (NVD)
Unvalidated pathnames in the web interface in Teledyne FLIR Aware2 versions through 6.9.0.2 (PackBot) and 1.7.9 (FirstLook) allows remote unauthenticated attackers to read configuration and security parameters on Teledyne FLIR PackBot and FirstLook robots running this software via path traversal.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.