External risk intelligence

Teledyne FLIR Aware2 Path Traversal Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 10.0)

CVE-2026-55393

The vulnerability affects specialized robotics hardware (PackBot and FirstLook) which, while network-accessible, typically operates within isolated or tactical networks rather than being deployed as public-facing internet services.

Path Traversal

Halo Surface Signal: 2 out of 5 — less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This vulnerability involves a flaw in the web interface of Teledyne FLIR's PackBot and FirstLook robots, potentially allowing unauthorized access to configuration and security data through a path traversal weakness.

Access to robot settings.
Affects specialized robotic equipment.
Confirm relevance and exposure.

Attack Path

How an attacker could exploit the issue

Attackers can exploit unvalidated pathnames in the web interface to read sensitive configuration and security data from Teledyne FLIR robots. This allows remote, unauthenticated attackers to access information that could compromise the robot's security.

Remote, unauthenticated access required.
Path traversal in web interface triggers vulnerability.
Risk of reading configuration and security parameters.

Live Threat

Current exploitation, exposure, and threat context

An unauthenticated remote attacker could read configuration and security parameters from Teledyne FLIR PackBot and FirstLook robots by exploiting unvalidated pathnames in the web interface. This could potentially expose sensitive system settings and operational details.

Configuration and security parameters at risk.
Exposure via path traversal through the web interface.
Sensitive system information could be revealed.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability impacts specialized Teledyne FLIR robotics hardware, suggesting that owners of these devices, along with the teams managing their operational technology (OT) environments and security posture, should take the lead. The initial step is to inventory all deployed PackBot and FirstLook robots, confirm their network exposure and operational criticality, and then coordinate with Teledyne FLIR or an authorized service provider for remediation planning.

Owner: Robotics or OT operational teams.
Verify: Robot network exposure and criticality.
Action: Plan vendor-assisted remediation.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Teledyne FLIR Aware2 software?

Aware2 is the operating software for specialized Teledyne FLIR robots, including PackBot and FirstLook models. These robots are designed for hazardous duty tasks like reconnaissance, explosive ordnance disposal, and tactical inspections. The software manages the robot's onboard systems and provides the web-based interface used by operators to control the device and monitor its surroundings.

How does CVE-2026-55393 work?

This vulnerability is a path traversal flaw, categorized as CWE-22. It happens when the robot's web interface fails to properly filter file path names. By sending specially crafted web requests, an unauthorized user can trick the software into looking outside its intended directories, allowing them to read sensitive files containing system configurations and security parameters that should be restricted.

What triggers this path traversal?

The vulnerability is triggered when an attacker sends a malicious request to the robot's web interface. Crucially, the system does not require any authentication or user interaction to be exploited. Legitimate use of the robot's standard controls or user-authorized monitoring does not trigger this flaw; it specifically requires the intentional use of manipulated file path characters.

Do I need to worry about my robots?

Your concern depends on where your devices are deployed. According to Halo Surface Signal, while these robots are network-accessible, they are typically used in isolated or tactical environments rather than as public-facing internet services. If your robots are restricted to secure, private, or air-gapped networks, your risk is significantly lower than devices connected to broader, less-controlled networks.

What is the first step to address this?

Start by identifying all PackBot and FirstLook robots in your inventory to understand where they are deployed. Once you have a list, verify how these devices are connected to your network. Focus on confirming that they remain within protected, tactical segments. Finally, contact Teledyne FLIR or your authorized support representative to receive official guidance on remediation and software updates.

References

github.com/mandiant/Vulnerability-Disclosures/blob/master/2026/M…

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.