CVE-2026-55396: Unencrypted UDP Control Traffic in Teledyne FLIR Robots running Aware2
Cleartext transmission without a cryptographic integrity check in operator control unit to robot UDP traffic in Teledyne FLIR Aware2 versions through 6.9.0.2 (PackBot) and 1.7.9 (FirstLook) allows adjacent unauthenticated attackers to intercept, hijack, or modify control traffic against Teledyne FLIR PackBot and FirstLook robots running this software via sniffing or hijacking network traffic.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Teledyne FLIR PackBot robots running Aware2 through version 6.9.0.2 and FirstLook robots running Aware2 through version 1.7.9 are affected. Exposure requires operator control unit-to-robot UDP traffic that an adjacent attacker can observe or interfere with.
What does an attacker need to exploit the vulnerability?
An attacker must be adjacent to the relevant network traffic and able to sniff or hijack UDP communications between the operator control unit and the robot. No authentication is required for the attacker.
What actions can a successful attacker take?
A successful attacker can intercept, hijack, or modify operator control traffic sent to the robot. The traffic is transmitted in cleartext and lacks a cryptographic integrity check.