CRITICAL 10.0 NVD

CVE-2026-55393

Unvalidated pathnames in the web interface in Teledyne FLIR Aware2 versions through 6.9.0.2 (PackBot) and 1.7.9 (FirstLook) allows remote unauthenticated attack

Unvalidated pathnames in the web interface in Teledyne FLIR Aware2 versions through 6.9.0.2 (PackBot) and 1.7.9 (FirstLook) allows remote unauthenticated attackers to read configuration and security parameters on Teledyne FLIR PackBot and FirstLook robots running this software via path traversal.

References

https://github.com/mandiant/Vulnerability-Disclosures/blob/master/2026/MNDT-2026-0029.md

Published: 2026-10-01 · Source: NVD · Feed updated: 2026-10-02

This critical severity vulnerability with a CVSS score of 10.0 was published on 2026-10-01 via NVD.

Risk Timeline

CVE Disclosed2026-10-01 · 0 days ago

Remediation Resources

GitHub

github.com/mandiant/Vulnerability-Disclosures/blob/master/2026/MNDT-20

vulnfeed aggregates 9442 vulnerabilities from NVD, CISA KEV, Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.