by Kastro
Paper/Archive/CVE-2026-14984

CVE-2026-14984

Teledyne FLIR Aware2 — Cleartext HTTP for Control Traffic in Teledyne FLIR Robots running Aware2

EPSS 0.1%CVSS 9.4
critical.is priorityof 100
29
CVSS 9.4 (CNA)9.4 / 10 × 3028.2Not in CISA KEV+300.0EPSS percentile 3.6.036 × 200.7No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Cleartext transmission in the primary control endpoints of Teledyne FLIR Aware2 versions through 6.9.0.2 allows remote unauthenticated attackers to intercept, hijack, or modify session traffic against Teledyne FLIR PackBot robots running this software via sniffing or hijacking network traffic.

Affected

ProductAffectedFixed inSource
Aware2≤ 6.9.0.2–CNA

Scores by source

Mandiant (CNA)9.4CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

writeupgithub.com/mandiant/Vulnerability-Disclosures/blob/master/2026/MNDT-2026-0028.md