Teledyne FLIR Aware2 EUVD-2026-91050

Exploitation requires network reachability to the web interface of a Teledyne FLIR PackBot (Aware2 ≤6.9.0.2) or FirstLook (Aware2 ≤1.7.9) robot; no authentication, credentials, or user interaction are needed per the CVSS vector (PR:N/UI:N). The only real limiting factor is exposure of the robot's management web interface - these platforms are typically operated on isolated tactical, operational, or air-gapped networks rather than the public internet, which substantially constrains who can reach the vulnerable endpoint. Impact is limited to reading configuration and security parameters (information disclosure); no write or command-execution capability is described.

Multiple signals point to a genuinely high-severity, easy-to-exploit flaw, but the raw CVSS 4.0 score of 10.0 overstates the actual impact. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) correctly indicates remote, unauthenticated, low-complexity exploitation with no user interaction, which matches the description of a path traversal in the web interface. However, the vector asserts VC:H/VI:H/VA:H and subsequent-system SC:H/SI:H/SA:H, whereas the description states only that an attacker can READ configuration and security parameters - a confidentiality impact. There is no evidence in the description of write/integrity or availability impact, so the full-impact 10.0 rating appears inflated; a read-only traversal is more consistent with a high-confidentiality, no-integrity/availability profile (closer to CVSS ~7.5). No EPSS score, CISA KEV listing, or public exploit code is present in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The vulnerability was reported by Mandiant (a credible source) via a coordinated disclosure advisory. Net assessment: technically trivial to exploit if the web interface is reachable, and valuable for reconnaissance (leaked security parameters), but the affected products are niche field robots rather than ubiquitous enterprise software, and real-world risk depends heavily on network exposure of the robot's management interface.

A remote, unauthenticated attacker with network reach to a PackBot or FirstLook robot's web interface sends a crafted HTTP request containing path traversal sequences (e.g., ../) to escape the intended web root and retrieve configuration files and stored security parameters. Because the CVSS vector indicates no authentication, no user interaction, and low complexity, the request succeeds against the exposed interface without credentials. No public exploit code is identified at time of analysis, though the technique is simple to reproduce from the disclosure details.