CVE-2026-55394 Overview
CVE-2026-55394 affects Teledyne FLIR Aware2 software running on Teledyne FLIR PackBot robots. The vulnerability stems from unencrypted traffic on the 802.11 wireless network used by the platform. Adjacent unauthenticated attackers within wireless range can intercept, hijack, or modify session traffic by sniffing or hijacking communications between the operator and the robot. The flaw is categorized under [CWE-319] Cleartext Transmission of Sensitive Information. All Teledyne FLIR Aware2 versions through 6.9.0.2 are affected.
Critical Impact
Attackers within wireless range can intercept operator-robot sessions and modify traffic sent to PackBot robots without any authentication.
Affected Products
- Teledyne FLIR Aware2 versions through 6.9.0.2
- Teledyne FLIR PackBot robots running Aware2 software
- 802.11 wireless control sessions between operator consoles and PackBot platforms
Discovery Timeline
- 2026-10-01 - CVE-2026-55394 published to the National Vulnerability Database
- 2026-10-02 - Record last modified in NVD
- Disclosure - Published by Mandiant as advisory MNDT-2026-0030
Technical Details for CVE-2026-55394
Vulnerability Analysis
Teledyne FLIR Aware2 transmits control and telemetry data over an 802.11 wireless link without applying transport encryption. Session traffic between the operator interface and the PackBot robot traverses the air in cleartext. Any attacker within radio range of the 802.11 network can passively capture frames or actively inject them. Because the protocol does not provide authenticated encryption, the operator and robot cannot distinguish legitimate traffic from attacker-injected traffic.
The exposure matters because PackBot robots are used in explosive ordnance disposal, hazardous materials handling, and tactical reconnaissance. Loss of session confidentiality reveals operational video feeds, sensor telemetry, and command sequences. Loss of session integrity allows an attacker to alter or substitute commands sent to the robot.
Root Cause
The root cause is missing cryptographic protection on the 802.11 session channel. Aware2 relies on the underlying wireless network for confidentiality but does not add an application-layer encrypted tunnel. When the wireless layer is weak, open, or shared, the session traffic is exposed. [CWE-319] describes this class of cleartext transmission flaw.
Attack Vector
The attack vector is Adjacent Network. An attacker must be within 802.11 radio range of the operator console or the robot. From that position, the attacker can run a wireless sniffer to capture session content, perform a man-in-the-middle attack to hijack an active session, or inject modified frames to alter commands and responses. No credentials and no user interaction are required on the Aware2 side.
See the Mandiant MNDT-2026-0030 advisory for additional technical context.
Detection Methods for CVE-2026-55394
Indicators of Compromise
- Unexpected 802.11 stations associated with the operator or robot wireless network, especially devices with vendor OUIs that do not match issued hardware.
- Duplicate MAC addresses or ARP anomalies on the control network indicating a man-in-the-middle position.
- Unexplained command retries, latency spikes, or robot actions that do not match operator inputs.
Detection Strategies
- Perform wireless packet captures during robot operations and verify that payload traffic is encrypted at the link or transport layer.
- Deploy a wireless intrusion detection sensor near PackBot deployment areas to flag rogue access points, deauthentication floods, and injection attempts.
- Correlate operator session logs with robot-side command logs to identify commands that were executed without a matching operator-issued entry.
Monitoring Recommendations
- Continuously monitor the RF environment around PackBot operations for new SSIDs and unauthorized stations.
- Capture and retain 802.11 management and control frames to support post-incident forensics on suspected hijack events.
- Alert on changes to the set of MAC addresses associated with the operator console or robot during a mission.
How to Mitigate CVE-2026-55394
Immediate Actions Required
- Restrict PackBot operations to physically controlled areas where 802.11 range is limited and adversary presence is unlikely.
- Configure the operator-to-robot wireless link with WPA2-Enterprise or WPA3 using strong, unique credentials and disable open or WEP networks.
- Treat the 802.11 segment carrying Aware2 traffic as untrusted and isolate it from other networks.
Patch Information
No vendor patch is listed in the NVD record at the time of publication. Operators should contact Teledyne FLIR for guidance and track updates to Aware2 beyond version 6.9.0.2. Reference the Mandiant MNDT-2026-0030 disclosure for the current status.
Workarounds
- Tunnel Aware2 session traffic inside an authenticated VPN such as IPsec or WireGuard between the operator console and the robot where supported.
- Operate the robot on a dedicated, hidden SSID with MAC allow-listing and reduced transmit power to limit the attack surface.
- Suspend wireless operations and switch to tethered control when operating in environments with suspected adversary signals intelligence capability.
# Configuration example: harden the dedicated PackBot SSID on a WPA2-Enterprise capable AP
ssid PACKBOT-OPS
authentication open
authentication key-management wpa version 2
encryption mode ciphers aes-ccm
no broadcast-ssid
radio-policy restrict 5ghz
power local 25
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
