CVE-2026-55395: Teledyne FLIR Aware2 Auth Bypass Vulnerability

CVE-2026-55395 Overview

CVE-2026-55395 is a hardcoded credentials vulnerability in Teledyne FLIR Aware2 software used on PackBot and FirstLook unmanned ground robots. The flaw affects Aware2 versions through 6.9.0.2 on PackBot and version 1.7.9 on FirstLook. Attackers can extract static passwords from the firmware or vendor documentation and use them to authenticate against the robot's access control interface. Successful authentication allows remote unauthenticated adversaries on the adjacent network to access and reconfigure the affected robots. The weakness is tracked as [CWE-798: Use of Hard-coded Credentials].

Critical Impact

Attackers on the adjacent network can authenticate using firmware-embedded passwords, take control of PackBot and FirstLook robots, and alter their configuration without any prior privileges.

Affected Products

• Teledyne FLIR Aware2 through 6.9.0.2 (PackBot)
• Teledyne FLIR Aware2 through 1.7.9 (FirstLook)
• Teledyne FLIR PackBot and FirstLook robot platforms running the affected Aware2 software

Discovery Timeline

• 2026-10-01 - CVE-2026-55395 published to NVD
• 2026-10-02 - Last updated in NVD database
• Reference - Mandiant Vulnerability Disclosure MNDT-2026-0031

Technical Details for CVE-2026-55395

Vulnerability Analysis

The Teledyne FLIR Aware2 software ships with passwords embedded directly in the firmware image and reproduced in product documentation. These static credentials gate access to the robot's control and configuration interface. Because the passwords are not unique per device and cannot be changed through a supported workflow, every deployed PackBot or FirstLook running the affected Aware2 build shares the same authentication secret. An adversary who extracts the firmware image, obtains a copy of the documentation, or reuses credentials disclosed in prior research can authenticate as a legitimate operator. The vulnerability requires only adjacent network access, which maps to the typical radio or Wi-Fi link used to command these robots in the field.

Root Cause

The root cause is the use of hard-coded authentication secrets in the access control layer of Aware2. Secure design requires per-device credentials, user-managed password rotation, and storage of secrets outside the shipped firmware. Aware2 violates these controls by binding the authentication check to constants compiled into the binary.

Attack Vector

Exploitation proceeds in two stages. First, the attacker recovers the password by reading the firmware image, decompiling Aware2 binaries, or consulting Teledyne FLIR documentation. Second, the attacker reaches the robot over an adjacent network, such as the robot's wireless control channel, and submits the recovered password to the access control service. No user interaction is required and no prior session on the device is needed. Once authenticated, the attacker can issue configuration changes and command the robot. Operators relying on these platforms for explosive ordnance disposal, reconnaissance, or hazardous-environment work face loss of control over physical assets.

No verified public exploit code is available. See the Mandiant Vulnerability Disclosure MNDT-2026-0031 for additional technical context.

Detection Methods for CVE-2026-55395

Indicators of Compromise

• Successful logins to the Aware2 access control interface from unknown or unauthorized operator control units.
• Configuration changes on PackBot or FirstLook robots that do not correlate with scheduled operator activity.
• Unexpected wireless clients associating with the robot's control radio or Wi-Fi network.
• Command and telemetry sessions originating from IP addresses outside the approved operator range.

Detection Strategies

• Baseline normal Aware2 authentication events and alert on logins outside expected operator hours or locations.
• Capture and inspect wireless traffic on robot control channels for authentication attempts using the known hardcoded credential set.
• Correlate robot movement, camera activation, and configuration events against mission logs to find unauthorized sessions.

Monitoring Recommendations

• Forward Aware2 access and configuration logs to a centralized logging platform for retention and correlation.
• Monitor the RF and IP perimeter around deployed robots for rogue control stations or unauthorized access points.
• Review firmware versions across the PackBot and FirstLook fleet and track which units remain on affected Aware2 builds.

How to Mitigate CVE-2026-55395

Immediate Actions Required

• Inventory all PackBot and FirstLook robots and record the Aware2 version running on each unit.
• Restrict the robot control network to authorized operator control units only, using link-layer isolation and strong wireless encryption.
• Treat the hardcoded Aware2 passwords as public and assume any device reachable over the control link is at risk until patched.
• Contact Teledyne FLIR support to obtain remediation guidance and any available firmware updates.

Patch Information

No vendor patch URL is listed in the NVD entry at publication. Operators should request a fixed Aware2 release from Teledyne FLIR that removes the hardcoded credentials and supports per-device, operator-managed passwords. Track updates through the Mandiant Vulnerability Disclosure MNDT-2026-0031 advisory.

Workarounds

• Operate affected robots only on isolated RF or wired networks with no bridge to untrusted segments.
• Disable or physically remove unused radios and network interfaces on the robot when not required for a mission.
• Enforce physical and operational security around deployed units so attackers cannot gain the adjacent network foothold needed to reach the access control service.
• Decommission or quarantine robots that cannot be upgraded to a fixed Aware2 release.