{"id":"CVE-2026-55393","state":"PUBLISHED","title":"Local File Inclusion in Teledyne FLIR Robots running Aware2","description":"Unvalidated pathnames in the web interface in Teledyne FLIR Aware2 versions through 6.9.0.2 (PackBot) and 1.7.9 (FirstLook) allows remote unauthenticated attackers to read configuration and security parameters on Teledyne FLIR PackBot and FirstLook robots running this software via path traversal.","publishedAt":"2026-10-01T19:59:20.334Z","updatedAt":"2026-10-01T20:28:55.051Z","severity":{"score":10,"label":"Critical","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","source":"Mandiant"},"assigner":"Mandiant","products":["Teledyne FLIR Aware2"],"affected":[{"vendor":"Teledyne FLIR","product":"Aware2","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThanOrEqual":"6.9.0.2","versionType":"semver"},{"version":"0","status":"affected","lessThanOrEqual":"1.7.9","versionType":"semver"}]}],"references":["https://github.com/mandiant/Vulnerability-Disclosures/blob/master/2026/MNDT-2026-0029.md"],"weaknesses":["CWE-22"],"ingestedAt":"2026-10-29T20:12:24.861Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/55xxx/CVE-2026-55393.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-55393","state":"PUBLISHED","datePublished":"2026-10-01T19:59:20.334Z","dateUpdated":"2026-10-01T20:28:55.051Z","assignerShortName":"Mandiant","assignerOrgId":"027e81ed-0dd4-4685-ab4d-884aec5bb484","dateReserved":"2026-06-16T19:45:37.214Z"},"containers":{"cna":{"title":"Local File Inclusion in Teledyne FLIR Robots running Aware2","descriptions":[{"lang":"en","value":"Unvalidated pathnames in the web interface in Teledyne FLIR Aware2 versions through 6.9.0.2 (PackBot) and 1.7.9 (FirstLook) allows remote unauthenticated attackers to read configuration and security parameters on Teledyne FLIR PackBot and FirstLook robots running this software via path traversal."}],"affected":[{"vendor":"Teledyne FLIR","product":"Aware2","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThanOrEqual":"6.9.0.2","versionType":"semver"},{"version":"0","status":"affected","lessThanOrEqual":"1.7.9","versionType":"semver"}]}],"references":[{"url":"https://github.com/mandiant/Vulnerability-Disclosures/blob/master/2026/MNDT-2026-0029.md","tags":["third-party-advisory"]}],"metrics":[{"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}],"cvssV4_0":{"attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","subConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","subIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subAvailabilityImpact":"HIGH","exploitMaturity":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED","version":"4.0","baseSeverity":"CRITICAL","baseScore":10,"vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-22","lang":"en","description":"CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","type":"CWE"}]}],"providerMetadata":{"shortName":"Mandiant","orgId":"027e81ed-0dd4-4685-ab4d-884aec5bb484","dateUpdated":"2026-10-01T19:59:20.334Z"},"impacts":[{"capecId":"CAPEC-497","descriptions":[{"lang":"en","value":"CAPEC-497: File Discovery"}]}],"source":{"discovery":"UNKNOWN"},"x_generator":{"engine":"Vulnogram 1.0.5"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-10-01T20:28:46.870936Z","id":"CVE-2026-55393","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-10-01T20:28:55.051Z"}}]}}}