Teledyne FLIR Aware2 CVE-2026-55394

Exploitation requires the attacker to be adjacent on the target's 802.11 wireless network used by the Teledyne FLIR PackBot running Aware2 (through 6.9.0.2), where session traffic is transmitted without encryption. The enabling condition is the inherent lack of transport encryption on this wireless link in affected versions. Limiting factors: the attacker must be within RF range of and able to sniff/associate with the robot's wireless network (adjacent vector, not internet-remote); no authentication or user interaction is needed, but physical/RF proximity to an operating robot is mandatory, which sharply narrows realistic opportunity to active deployments.

This is a medium-severity (CVSS 4.0 base 5.3) cleartext-transmission flaw (CWE-319) whose real-world risk is bounded primarily by its adjacency requirement. The CVSS 4.0 vector (AV:A/AC:L/AT:N/PR:N/UI:N) confirms an unauthenticated attacker with low complexity but requires adjacent network access - specifically presence on the same 802.11 wireless network - which materially limits the attacker population versus a network-remote flaw. Impact is partial across the triad (VC:L/VI:N/VA:L plus subsequent-system SC:L/SA:L), reflecting interception plus session hijack/manipulation against the controlled PackBot robot rather than full compromise. No EPSS score, CISA KEV listing, or public POC was provided in the intelligence set, so there is no evidence of widespread automated exploitation; the signals point to a targeted, proximity-dependent attack rather than mass exploitation. Note the vulnerability was reported by Mandiant (a credible source) but no vendor advisory or patched version is present in the data - remediation status is unconfirmed. Overall this is a real but situational risk: credible for an attacker already within RF range of a deployed robot, low priority for generic internet-facing attack surface.

An attacker positioned within wireless range of a PackBot robot's 802.11 network passively sniffs the unencrypted control/session traffic to recover operational data, then actively injects or hijacks session packets to alter or disrupt commands to the robot. No authentication or user interaction is required, but the attacker must be on the same wireless segment. No public exploit code was identified at time of analysis.