Teledyne FLIR Aware2 CVE-2026-55395

Exploitation requires (1) network/radio adjacency to a target PackBot or FirstLook robot running Aware2 ≤6.9.0.2 or ≤1.7.9 respectively - per CVSS AV:A, not open-internet reachability - and (2) knowledge of the built-in hardcoded passwords, which are obtainable by reading them from the device firmware image or from product documentation. No authentication is needed (PR:N) and no user interaction (UI:N); the credentials function against the affected software's access control by design, so any unpatched unit in the attacker's radio/network range is exploitable. The primary limiting factor is proximity and the specialized, access-controlled nature of the deployment base (defense/EOD operators), not any configuration prerequisite.

This is a genuine high-priority issue rather than an inflated CVSS score. CWE-798 (hardcoded credentials) combined with the CVSS 4.0 vector (AC:L/AT:N/PR:N/UI:N) means exploitation is trivial once an attacker is in range: no authentication, no special conditions, no user interaction, and full compromise of both the vulnerable system and subsequent systems (VC/VI/VA and SC/SI/SA all High), justifying the 9.4 critical rating. The one mitigating signal is the attack vector: CVSS 4.0 specifies AV:A (Adjacent), NOT network - this directly conflicts with the description's phrase 'remote unauthenticated attackers' and should be verified. Because PackBot/FirstLook are field-deployed robots typically controlled over wireless/radio links, 'adjacent' (radio/local-link proximity) is the more defensible reading, meaning an attacker must be within network/radio range rather than exploiting across the open internet. No EPSS score, no CISA KEV listing, and no public exploit code were provided; the Mandiant reference is a coordinated vulnerability disclosure, not a weaponized POC. Net: credible, easy-to-weaponize flaw with full impact, but real-world exposure is bounded by physical/radio proximity and the niche defense/EOD deployment base, not mass internet scanning.

An attacker within radio/network range of a FLIR PackBot or FirstLook robot extracts the hardcoded passwords from the publicly obtainable firmware or product documentation, then authenticates to the robot's access control interface. With valid built-in credentials they take over the device - reading its state and reconfiguring the robot - without any legitimate authorization. No public exploit code is identified at time of analysis, but the credentials themselves are the exploit and require no development effort.