CVE-2026-55393
Unauthenticated path traversal in Teledyne FLIR Aware2
- CVSS 4.0
- 10.0 critical
- EPSS
- —
- Published
- ·
- Modified
Teledyne FLIR Aware2 does not validate pathnames in its web interface, a path-traversal flaw (CWE-22). A remote attacker who is not authenticated can request crafted paths and read configuration and security parameters from robots running the software. The issue is rated critical (CVSS 4.0 base score 10.0). It affects Aware2 through version 6.9.0.2 on PackBot and through version 1.7.9 on FirstLook. It is not listed in CISA KEV, and no public proof-of-concept is known.
What to do: Treat Teledyne FLIR Aware2 through 6.9.0.2 on PackBot and through 1.7.9 on FirstLook as vulnerable and install any vendor release newer than those versions as soon as it is available. Until then, keep the Aware2 web interface off untrusted and internet-reachable networks, limit access to dedicated robot-control segments, and review logs and configuration for unexpected reads of security parameters.
| Product | Affected |
|---|---|
| Teledyne FLIR Aware2 on PackBot | through 6.9.0.2 |
| Teledyne FLIR Aware2 on FirstLook | through 1.7.9 |
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
Unvalidated pathnames in the web interface in Teledyne FLIR Aware2 versions through 6.9.0.2 (PackBot) and 1.7.9 (FirstLook) allows remote unauthenticated attackers to read configuration and security parameters on Teledyne FLIR PackBot and FirstLook robots running this software via path traversal.
- Weakness
- CWE-22
- Vector
- CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
In the news
0 storiesNo ingested article mentions this CVE yet.