CVE-2026-55395

Received Received - Intake

Hardcoded Passwords in Teledyne FLIR Aware2 Access Control

Publication date: 2026-10-01

Last updated on: 2026-10-01

Assigner: Mandiant Inc.

Description

Hardcoded passwords in the access control in Teledyne FLIR Aware2 versions through 6.9.0.2 (PackBot) and 1.7.9 (FirstLook) allows remote unauthenticated attackers to access and reconfigure Teledyne FLIR PackBot and FirstLook robots running this software via reading the passwords from the firmware or documentation.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-01

Last Modified

2026-10-01

Generated

2026-10-02

AI Q&A

2026-10-02

EPSS Evaluated

N/A

NVD

CVE-2026-55395

EUVD

EUVD-2026-91052

Affected Vendors & Products

Vendor	Product	Version / Range
teledyne	flir_aware2	to 6.9.0.2 (inc)
teledyne	packbot	to 6.9.0.2 (inc)
teledyne	firstlook	to 1.7.9 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-798	The product contains hard-coded credentials, such as a password or cryptographic key.

Attack-Flow Graph

Executive Summary

This vulnerability involves hardcoded passwords in the access control system of Teledyne FLIR Aware2 software versions up to 6.9.0.2 (PackBot) and 1.7.9 (FirstLook). Attackers can remotely access and reconfigure robots without authentication by extracting passwords from firmware or documentation.

Detection Guidance

Detection of this vulnerability requires checking for hardcoded passwords in Teledyne FLIR Aware2, PackBot, or FirstLook systems. Examine firmware files or documentation for default credentials. No specific commands are provided in the context.

Impact Analysis

Remote attackers could take control of PackBot or FirstLook robots, potentially leading to unauthorized operations, data breaches, or physical damage. This could affect military, law enforcement, or industrial applications using these robots.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR (data protection) and HIPAA (health information privacy). Organizations using these robots may face compliance failures, legal penalties, and reputational damage.

Mitigation Strategies

Immediately update Teledyne FLIR Aware2 to versions beyond 6.9.0.2 (PackBot) and 1.7.9 (FirstLook) to remove hardcoded passwords. If updates are unavailable, isolate affected robots from networks and restrict physical access to prevent unauthorized configuration changes.

Hi! I’m here to help you understand CVE-2026-55395. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70