CVE-2026-55396 in Aware2
Summary
by MITRE • 10/01/2026
Cleartext transmission without a cryptographic integrity check in operator control unit to robot UDP traffic in Teledyne FLIR Aware2 versions through 6.9.0.2 (PackBot) and 1.7.9 (FirstLook) allows adjacent unauthenticated attackers to intercept, hijack, or modify control traffic against Teledyne FLIR PackBot and FirstLook robots running this software via sniffing or hijacking network traffic.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/01/2026
The vulnerability identified in Teledyne FLIR Aware2 versions through 6.9.0.2 for the PackBot series and version 1.7.9 for the FirstLook robotic systems represents a critical failure in transport layer security, specifically involving the use of User Datagram Protocol without cryptographic integrity checks or encryption. This architectural flaw allows operator control units to communicate with the robots over UDP while leaving the data stream exposed to passive observation and active manipulation by any entity capable of accessing the same network segment. Because the protocol lacks mechanisms such as TLS or IPsec, there is no verification that the packets originate from a legitimate controller nor assurance that their contents have not been altered in transit. This absence of integrity protection means that the communication channel relies entirely on the physical security and isolation of the underlying network infrastructure rather than cryptographic guarantees, creating a significant attack surface for adversaries operating within range or possessing access to adjacent network segments.
From an operational perspective, this vulnerability enables adjacent unauthenticated attackers to perform man-in-the-middle attacks against the robotic systems. By sniffing the UDP traffic, an attacker can observe sensitive telemetry data and command sequences being transmitted between the control unit and the robot. More critically, because there is no integrity check, an attacker can hijack these sessions by injecting forged packets or modifying existing ones without detection. This capability allows for the remote manipulation of the robot's behavior, including altering navigation paths, disabling safety mechanisms, or executing unauthorized commands. In tactical environments where PackBot and FirstLook robots are deployed for bomb disposal, reconnaissance, or hazardous material handling, such interference could lead to mission failure, loss of equipment, or physical harm to personnel if the robot is directed into dangerous situations based on spoofed instructions.
The technical classification of this flaw aligns with CWE-319, which describes cleartext transmission of sensitive information without integrity checks, and CWE-256 regarding unprotected storage of credentials or keys that may facilitate such interception when combined with other weaknesses. In the context of the MITRE ATT&CK framework, this vulnerability facilitates techniques associated with Network Sniffing (T1040) for data exfiltration and Man-in-the-Middle attacks (T1046) for session hijacking or command injection. The lack of authentication also relates to CWE-287, an Improper Authentication issue at the protocol level, as any device on the network can impersonate a legitimate controller due to the absence of mutual verification mechanisms in the UDP payload structure.
Mitigation strategies must focus on isolating the control traffic from general-purpose networks and implementing cryptographic protections where possible. Ideally, vendors should update the firmware to enforce encrypted communication channels using TLS or DTLS over UDP to ensure both confidentiality and integrity of the command stream. In environments where immediate patching is not feasible, network segmentation via VLANs or firewalls can restrict access to only authorized operator control units by filtering traffic based on source IP addresses and ports associated with the robotic systems. Additionally, implementing intrusion detection systems configured to monitor for anomalous UDP patterns or unexpected packet injections can provide an additional layer of defense against active exploitation attempts until a permanent cryptographic fix is deployed.