CVE-2026-14984: Teledyne FLIR Aware2 Information Disclosure

CVE-2026-14984 Overview

CVE-2026-14984 is a cleartext transmission vulnerability affecting Teledyne FLIR Aware2 versions through 6.9.0.2. The flaw resides in the primary control endpoints used to communicate with Teledyne FLIR PackBot robots. Remote unauthenticated attackers on an adjacent network can intercept, hijack, or modify session traffic by sniffing or manipulating packets on the wire. The vulnerability is tracked under CWE-319: Cleartext Transmission of Sensitive Information.

Critical Impact
Attackers within network range can take unauthenticated control of PackBot robotic systems, intercept operator sessions, and inject arbitrary commands against mission-critical unmanned ground vehicles.

Affected Products

Teledyne FLIR Aware2 versions through 6.9.0.2
Teledyne FLIR PackBot robots running affected Aware2 software
Operator control stations communicating with Aware2 endpoints

Discovery Timeline

2026-10-01 - CVE-2026-14984 published to NVD
2026-10-02 - Last updated in NVD database

Technical Details for CVE-2026-14984

Vulnerability Analysis

The Aware2 software stack exposes primary control endpoints that transmit session traffic without encryption. Operators interact with PackBot robots over these endpoints, sending movement commands, telemetry requests, and video feed subscriptions. Because the protocol lacks confidentiality and integrity controls, any attacker with access to the same broadcast domain can observe the full session.

Mandiant documented the issue in disclosure MNDT-2026-0028. The disclosure confirms that session traffic between operator and robot can be hijacked without credentials. An attacker does not need to compromise either endpoint. Observing the exchange is sufficient to replay or forge control messages.

Root Cause

The root cause is the absence of transport-layer encryption on the control channel. The protocol transmits authentication material, session identifiers, and command payloads in plaintext. No mutual authentication or message integrity verification is performed, allowing packet injection against established sessions.

Attack Vector

Exploitation requires adjacent network access, such as a shared Wi-Fi, mesh radio, or wired segment used by the operator control unit. An attacker running a passive sniffer collects session tokens and command structure. With that context, the attacker can inject spoofed control frames that the robot accepts as legitimate. See the MNDT-2026-0028 disclosure for additional technical context.

No verified proof-of-concept code is published.
Refer to the Mandiant disclosure for protocol-level details.

Detection Methods for CVE-2026-14984

Indicators of Compromise

Unexpected control sessions originating from hosts other than the authorized operator control unit
Duplicate or out-of-sequence command frames observed on the robot control VLAN
Unexplained movement, pan/tilt, or payload actuation on PackBot platforms during idle operator sessions

Detection Strategies

Deploy network sensors on the operator-to-robot segment to flag plaintext control protocol traffic and anomalous source addresses
Baseline normal command rates and alert on bursts or malformed command frames inconsistent with operator behavior
Correlate operator console audit logs with observed robot telemetry to identify commands with no originating console entry

Monitoring Recommendations

Capture and retain full packet captures of robot control segments for forensic review
Monitor wireless spectrum used by the robot link for unauthorized stations associating with the control network
Alert on any ARP spoofing, rogue DHCP, or MAC address changes within the control subnet

How to Mitigate CVE-2026-14984

Immediate Actions Required

Isolate PackBot control networks from general-purpose wired and wireless infrastructure
Restrict physical and radio access to the operator control environment during deployments
Disable or restrict Aware2 control endpoints that are not required for the current mission profile

Patch Information

No vendor patch is referenced in the NVD entry at the time of publication. Operators should contact Teledyne FLIR for updated Aware2 firmware beyond version 6.9.0.2 and monitor the Mandiant disclosure MNDT-2026-0028 for fix availability.

Workarounds

Tunnel all Aware2 control traffic through an encrypted overlay such as IPsec or WireGuard between operator and robot
Enforce strict Layer 2 segmentation with 802.1X on wired control links and WPA3-Enterprise on wireless links
Deploy out-of-band monitoring to detect unauthorized stations before field deployment

bash

# Example: establish a WireGuard tunnel on the operator control host
wg-quick up packbot-control
ip route add 10.42.0.0/24 dev packbot-control
# Verify only tunneled traffic reaches the robot
tcpdump -i eth0 host 10.42.0.10 and not udp port 51820