FLIR Aware2 EUVD-2026-91048

Exploitation requires network adjacency (CVSS AV:A) - the attacker must reach the Aware2 web interface on the local or adjacent network segment of a PackBot robot running Aware2 version 6.9.0.2 or earlier; this is NOT internet-remote. No authentication is required (PR:N) and no user interaction (UI:N) because the reboot endpoint lacks any authentication control (CWE-306). The specific prerequisite is reachability of the Aware2 web interface's reboot endpoint; the limiting factor is that the attacker must already hold a position on the adjacent network, which bounds exposure to operational/field networks rather than the open internet. Impact is confined to denial of service (robot reboot); there is no data exposure or code execution.

This is a genuine but bounded risk, best characterized as a moderate operational-availability issue rather than a top-tier emergency. The CVSS 4.0 vector (AV:A/AC:L/PR:N/UI:N, VA:H, score 7.1) confirms low-complexity, unauthenticated exploitation but critically specifies an ADJACENT network vector (AV:A) - not fully remote internet-facing access - so the attacker must already be on the same local/adjacent network segment as the PackBot robot. The only impact is availability (VA:H); there is no confidentiality or integrity loss (VC:N/VI:N), matching the CWE-306 missing-authentication DoS described. All exploitation signals point AWAY from urgency: SSVC rates Exploitation as 'none', Automatable as 'no', and Technical Impact as only 'partial'; there is no CISA KEV listing and no public exploit identified at time of analysis, so this is 'no public exploit identified at time of analysis.' The signals are internally consistent rather than conflicting - the moderately high 7.1 is driven by the easy unauthenticated trigger and high availability impact, tempered by the adjacent-only vector. The practical priority is therefore elevated specifically for operators of FLIR PackBot fleets where an attacker could gain adjacent network access (e.g., field-deployed or shared operational networks), but it is low priority for general enterprise IT. No key data appears contradictory; the main missing element is any patched-version confirmation beyond 'through 6.9.0.2'.

An attacker with access to the same local or adjacent network as a Teledyne FLIR PackBot robot sends an unauthenticated request to the Aware2 web interface's reboot endpoint, which lacks any authentication check. The robot reboots on demand, and repeated calls keep it offline, denying its availability during an operation. No public exploit code has been identified, and the low complexity (AC:L) means no special timing or conditions are required once network adjacency is achieved.