Teledyne FLIR Aware2: Cleartext transmission of control traffic to robots
Summary
Teledyne FLIR Aware2 software, used on PackBot and FirstLook robots, sends operator control and telemetry traffic over UDP without encryption or integrity checks. An adjacent, unauthenticated attacker on the same network segment can sniff, intercept, hijack or modify this traffic. Forged control packets could allow manipulation of robot movements and disruption of operations. Wireless links are the most exposed; fiber-optic tethering reduces the risk.
Affected
- Teledyne FLIR Aware2 for PackBot: versions through 6.9.0.2
- Teledyne FLIR Aware2 for FirstLook: versions through 1.7.9
Fixed in
Unknown. No fixed version is confirmed for this CVE. Teledyne provided remediation guidance on 2026-09-30, but its content was not available to us. Contact Teledyne at UGS-CHELMSFORD-TEAMS-FSE@Teledyne.com for updated software.
Workaround
- Unknown from the sources available.
- Isolate the robot control network and restrict layer-2 and layer-3 access to it.
- Use the fiber-optic control tether where possible to avoid wireless exposure.
Exploitation
- No exploitation in the wild known.
- No public proof-of-concept code known.
- The Mandiant advisory contains no POC or exploit code.
- CISA Exploitation status: none, according to the CISA SSVC assessment in the CVE record.
Our recommendation
- Check whether your organisation owns, operates or hosts PackBot or FirstLook robots. If not, no action needed.
- If you operate these robots, obtain remediation guidance and updated software from Teledyne.
- Isolate control networks, restrict access and prefer fiber-optic tethering over wireless links.
- Review CVE-2026-55395 and CVE-2026-55393 from the same batch, which are more exposed.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Mandiant MNDT-2026-0032 advisory github.com
- VulDB CVE-2026-55396 vuldb.com
- Strix CVE-2026-55396 www.strix.ai
- OpenCVE CVE-2026-55396 app.opencve.io
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 11:36.
Original description (NVD)
Cleartext transmission without a cryptographic integrity check in operator control unit to robot UDP traffic in Teledyne FLIR Aware2 versions through 6.9.0.2 (PackBot) and 1.7.9 (FirstLook) allows adjacent unauthenticated attackers to intercept, hijack, or modify control traffic against Teledyne FLIR PackBot and FirstLook robots running this software via sniffing or hijacking network traffic.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.