Cleartext Transmission in Teledyne FLIR Aware2

Executive Summary

This vulnerability involves cleartext transmission in the primary control endpoints of Teledyne FLIR Aware2 versions through 6.9.0.2. It allows remote unauthenticated attackers to intercept, hijack, or modify session traffic for Teledyne FLIR PackBot robots by sniffing or hijacking network traffic.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, monitor network traffic for unencrypted HTTP communication from Teledyne FLIR Aware2 or PackBot devices. Use packet sniffing tools like Wireshark or tcpdump to capture traffic and check for plaintext session tokens or authentication IDs. Example commands: tcpdump -i eth0 -w capture.pcap port 80 or Wireshark with a filter for http.

Useful 0 Not Useful 0

Impact Analysis

Attackers on the same local network can capture sensitive session information like authentication IDs, leading to session token compromise. This enables unauthorized control over the robot's functions, hijacking of control sessions, or denial-of-service, preventing legitimate operators from controlling the robot.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability involves cleartext transmission of sensitive session data, which could expose authentication IDs and control commands. Such exposure may violate data protection requirements under GDPR (e.g., Article 32 on security of processing) and HIPAA (e.g., Security Rule for integrity and confidentiality of ePHI) if the intercepted data includes personal or health information.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately isolate affected Teledyne FLIR Aware2 and PackBot devices from untrusted networks. Disable HTTP access and enforce HTTPS for all control endpoints. Update to the latest patched version if available. Restrict network access to only trusted users and implement network segmentation to limit exposure.

Useful 0 Not Useful 0