CVE-2026-55393

CVSS 10.0 (critical) · published 2026-10-01

Unvalidated pathnames in the web interface in Teledyne FLIR Aware2 versions through 6.9.0.2 (PackBot) and 1.7.9 (FirstLook) allows remote unauthenticated attackers to read configuration and security parameters on Teledyne FLIR PackBot and FirstLook robots running this software via path traversal.

Weakness: CWE-22

Source: NVD CVE-2026-55393

References

• https://github.com/mandiant/Vulnerability-Disclosures/blob/master/2026/MNDT-2026-0029.md

Check your software

Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.