by Kastro
Paper/Archive/CVE-2026-55393

CVE-2026-55393

Teledyne FLIR Aware2 — Local File Inclusion in Teledyne FLIR Robots running Aware2

EPSS 0.4%CVSS 10.0
critical.is priorityof 100
37
CVSS 10.0 (CNA)10.0 / 10 × 3030.0Not in CISA KEV+300.0EPSS percentile 37.1.371 × 207.4No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Unvalidated pathnames in the web interface in Teledyne FLIR Aware2 versions through 6.9.0.2 (PackBot) and 1.7.9 (FirstLook) allows remote unauthenticated attackers to read configuration and security parameters on Teledyne FLIR PackBot and FirstLook robots running this software via path traversal.

Affected

ProductAffectedFixed inSource
Aware2≤ 6.9.0.2–CNA
Aware2≤ 1.7.9–CNA

Scores by source

Mandiant (CNA)10.0CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

writeupgithub.com/mandiant/Vulnerability-Disclosures/blob/master/2026/MNDT-2026-0029.md