by Kastro
Paper/Archive/CVE-2026-55395

CVE-2026-55395

Teledyne FLIR Aware2 — Hardcoded Passwords in Teledyne FLIR Robots running Aware2

EPSS 0.2%CVSS 9.4
critical.is priorityof 100
30
CVSS 9.4 (CNA)9.4 / 10 × 3028.2Not in CISA KEV+300.0EPSS percentile 8.1.081 × 201.6No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Hardcoded passwords in the access control in Teledyne FLIR Aware2 versions through 6.9.0.2 (PackBot) and 1.7.9 (FirstLook) allows remote unauthenticated attackers to access and reconfigure Teledyne FLIR PackBot and FirstLook robots running this software via reading the passwords from the firmware or documentation.

Affected

ProductAffectedFixed inSource
Aware2≤ 6.9.0.2–CNA
Aware2≤ 1.7.9–CNA

Scores by source

Mandiant (CNA)9.4CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

writeupgithub.com/mandiant/Vulnerability-Disclosures/blob/master/2026/MNDT-2026-0031.md