CVE-2026-55393: Teledyne FLIR Aware2 Path Traversal Flaw

CVE-2026-55393 Overview

CVE-2026-55393 is a path traversal vulnerability in the web interface of Teledyne FLIR Aware2 software. The flaw affects Aware2 versions through 6.9.0.2 on PackBot robots and version 1.7.9 on FirstLook robots. Unauthenticated remote attackers can traverse directory structures to read sensitive configuration and security parameters. The vulnerability is tracked under CWE-22 (Improper Limitation of a Pathname to a Restricted Directory). Mandiant disclosed the issue through advisory MNDT-2026-0029. Because the affected robots are deployed in military, public safety, and industrial inspection roles, exposure of configuration data has operational security implications.

Critical Impact
Unauthenticated remote attackers can read configuration files and security parameters from PackBot and FirstLook robots over the network without any user interaction.

Affected Products

Teledyne FLIR Aware2 versions through 6.9.0.2 (PackBot)
Teledyne FLIR Aware2 version 1.7.9 (FirstLook)
Teledyne FLIR PackBot and FirstLook robotic platforms running the above software

Discovery Timeline

2026-10-01 - CVE-2026-55393 published to NVD
2026-10-02 - Last updated in NVD database
Vulnerability disclosed by Mandiant via advisory MNDT-2026-0029

Technical Details for CVE-2026-55393

Vulnerability Analysis

The web interface shipped with Teledyne FLIR Aware2 fails to validate user-supplied pathnames in HTTP requests. An attacker can submit crafted path parameters that escape the intended web root and traverse to arbitrary locations on the robot's filesystem. The flaw requires no authentication and no user interaction. Successful requests return the contents of files containing configuration state and security parameters used to operate the robot. Because PackBot and FirstLook are tactical robots used in reconnaissance, explosive ordnance disposal, and hazardous-environment missions, leaked parameters can expose network topology, credentials, and operational configuration that enable follow-on attacks against the device or its command infrastructure.

Root Cause

The root cause is improper limitation of a pathname to a restricted directory, classified as [CWE-22]. The web interface accepts path components containing traversal sequences such as ../ and resolves them against the server filesystem without canonicalization or allowlist enforcement. The lack of authentication on the affected endpoints compounds the exposure by removing any barrier to reaching the vulnerable handler.

Attack Vector

The attack vector is network-based. An attacker reachable over the robot's web interface sends HTTP requests containing directory traversal sequences in a file or path parameter. The server resolves the manipulated path and returns the contents of files outside the intended directory. No credentials, tokens, or victim interaction are required. Exploitation can be performed with standard HTTP tooling such as curl or a browser. See the Mandiant advisory for technical specifics and request examples.

Detection Methods for CVE-2026-55393

Indicators of Compromise

HTTP requests to the Aware2 web interface containing traversal sequences such as ../, ..%2f, or ..%5c in URL path or query parameters
Requests referencing sensitive file paths such as /etc/passwd, /etc/shadow, or Aware2 configuration files outside the web root
Unexpected egress from robot management networks to unknown external IP addresses
Access to the web interface from source IPs that do not match the operator inventory

Detection Strategies

Inspect web server access logs on affected robots for URL-decoded traversal patterns and encoded variants
Deploy network intrusion detection signatures targeting HTTP path traversal patterns directed at the Aware2 management interface
Correlate anomalous web requests with device identity to identify repeated probing against the same robot
Baseline normal operator interactions with the Aware2 interface and alert on deviations

Monitoring Recommendations

Forward Aware2 web server logs to a centralized logging platform for retention and query
Alert on sequential 200-OK responses to requests containing traversal sequences, which indicate successful file reads
Monitor for enumeration patterns such as rapid, sequential requests to varying file paths from the same source
Audit which hosts and networks can reach the robot management interface and review changes over time

How to Mitigate CVE-2026-55393

Immediate Actions Required

Remove the Aware2 web interface from untrusted networks and restrict access to a dedicated operator management VLAN
Place affected PackBot and FirstLook robots behind a firewall that denies inbound HTTP from arbitrary sources
Rotate any credentials, keys, or configuration secrets that may have been exposed through the web interface
Review web server logs for prior exploitation attempts referencing path traversal sequences

Patch Information

No vendor patch is referenced in the NVD entry at publication time. Operators should contact Teledyne FLIR for firmware updates addressing CVE-2026-55393 and monitor the Mandiant advisory for updates on remediation status.

Workarounds

Block external network access to the Aware2 web interface using host or perimeter firewall rules
Require VPN access with multi-factor authentication before reaching the robot management network
Disable the web interface during missions where remote configuration is not required
Segment robot management traffic from general enterprise and operational networks

bash

# Example iptables rule to restrict Aware2 web interface to a trusted operator subnet
iptables -A INPUT -p tcp --dport 80 -s 10.10.20.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -s 10.10.20.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j DROP
iptables -A INPUT -p tcp --dport 443 -j DROP