CVE-2026-55396 Overview
CVE-2026-55396 is a cleartext transmission vulnerability affecting Teledyne FLIR Aware2 software running on PackBot and FirstLook unmanned ground robots. The operator control unit (OCU) sends control traffic to the robot over UDP without encryption or cryptographic integrity checks. Adjacent unauthenticated attackers on the same network segment can sniff, modify, or hijack this control traffic. The flaw is tracked as CWE-319: Cleartext Transmission of Sensitive Information.
Critical Impact
Attackers with adjacent network access can intercept or hijack robot control traffic, enabling unauthorized command injection against deployed PackBot and FirstLook robots.
Affected Products
- Teledyne FLIR Aware2 through version 6.9.0.2 (PackBot)
- Teledyne FLIR Aware2 through version 1.7.9 (FirstLook)
- Operator control unit (OCU) to robot UDP communication channel
Discovery Timeline
- 2026-10-01 - CVE-2026-55396 published to NVD
- 2026-10-02 - Last updated in NVD database
- Disclosure coordinated through Mandiant Vulnerability Disclosure (MNDT-2026-0032)
Technical Details for CVE-2026-55396
Vulnerability Analysis
Teledyne FLIR PackBot and FirstLook are tactical unmanned ground robots used in explosive ordnance disposal, reconnaissance, and hazardous environment operations. The Aware2 software stack handles operator control unit communication, including motion commands, sensor telemetry, and payload operation. Control messages travel between the OCU and the robot over UDP in cleartext. The protocol lacks message authentication codes, digital signatures, or transport encryption. An attacker with adjacent network access can passively observe operator commands or actively inject forged packets. Successful exploitation undermines robot availability and integrity in operational environments where command authenticity is required.
Root Cause
The root cause is a design-level omission of cryptographic protections on the OCU-to-robot UDP channel. Neither confidentiality nor integrity controls are applied to the control protocol. Without a shared secret, pre-shared keys, or certificate-based mutual authentication, the receiver has no mechanism to validate the sender or detect tampering with command payloads.
Attack Vector
Exploitation requires adjacent network access, typically the wireless link between the OCU and the robot. An attacker within radio range can sniff UDP packets to reconstruct the command protocol. The attacker can then craft and transmit forged UDP packets to the robot, overriding legitimate operator input. Hijacking scenarios include unauthorized movement, payload actuation, or interruption of mission commands. See the MNDT-2026-0032 advisory for protocol-level details.
Detection Methods for CVE-2026-55396
Indicators of Compromise
- Unexpected UDP packets on the OCU-to-robot control channel from unknown source addresses
- Robot movement or payload activation not initiated by the authorized operator
- Duplicate or out-of-sequence control messages observed in protocol captures
- Unexplained loss of control responsiveness during active missions
Detection Strategies
- Capture wireless traffic during robot operation and verify all control packets originate from the authorized OCU MAC and IP
- Baseline the expected UDP command rate and alert on volume or timing anomalies
- Correlate operator input logs on the OCU with command packets observed on the wire
Monitoring Recommendations
- Deploy a passive wireless monitor near operational areas to detect rogue transmitters on the robot control frequencies
- Log all OCU session start and stop events for post-mission forensic review
- Monitor the operational radio spectrum for unauthorized devices during active deployments
How to Mitigate CVE-2026-55396
Immediate Actions Required
- Restrict robot operations to physically controlled areas where adjacent network access by adversaries is limited
- Contact Teledyne FLIR support to confirm availability of a patched Aware2 release addressing MNDT-2026-0032
- Inventory all deployed PackBot units running Aware2 through 6.9.0.2 and FirstLook units running Aware2 through 1.7.9
- Treat the OCU-to-robot link as untrusted and avoid use in contested electromagnetic environments until mitigated
Patch Information
No vendor patch URL is published in the NVD record at the time of writing. Operators should contact Teledyne FLIR directly and reference the Mandiant disclosure MNDT-2026-0032 to confirm fixed firmware versions and upgrade procedures.
Workarounds
- Operate robots only in environments where adversary proximity to the OCU radio link can be excluded
- Where feasible, tunnel OCU-to-robot UDP traffic through a link-layer encryption appliance that provides authenticated encryption
- Shorten mission duration and operator-to-robot distance to reduce the window and footprint available for sniffing or injection
- Maintain visual line-of-sight on the robot and be prepared to initiate manual safe-stop if anomalous behavior occurs
# Configuration example
# No vendor-supplied configuration mitigation is published for CVE-2026-55396.
# Refer to MNDT-2026-0032 and Teledyne FLIR support for authoritative guidance.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
