Quick answers
- Is CVE-2026-55395 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-55395 being exploited in the wild.
- How severe is CVE-2026-55395?
- Informational severity, published 1 October 2026.
- Which products and versions are affected?
- Teledyne FLIR Aware2 through 6.9.0.2 (PackBot) and 1.7.9 (FirstLook); Teledyne FLIR FirstLook 110; Teledyne FLIR PackBot 510.
- Is there a fix for CVE-2026-55395?
- No fixed version is recorded yet. Contact Teledyne at UGS-CHELMSFORD-TEAMS-FSE@Teledyne.com for updated software and remediation instructions. Until patched, restrict network access to these devices to trusted operators only and disable unnecessary remote access services where operationally feasible.</anigation> <parameter name="fixed_in"><UNKNOWN> If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-55395 attacked?
- It is attacked over the network or from the adjacent network, in a network appliance.
- Am I affected by CVE-2026-55395?
- Check whether you run Teledyne FLIR Aware2, Teledyne FLIR FirstLook or Teledyne FLIR PackBot at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
Contact Teledyne at UGS-CHELMSFORD-TEAMS-FSE@Teledyne.com for updated software and remediation instructions. Until patched, restrict network access to these devices to trusted operators only and disable unnecessary remote access services where operationally feasible.</anigation> <parameter name="fixed_in"><UNKNOWN>
Technical details
The vulnerability is the use of hardcoded, globally shared administrative credentials in multiple system components (robot OS, Operator Control Units, mesh radio modules) without per-device provisioning. An attacker with network access to SSH, Telnet, or similar services on the affected devices can authenticate as root using static passwords disclosed in firmware or documentation. Exploitation requires network connectivity; in typical deployments this means physical proximity to the device's wireless network, but exposes all units in a product line equally due to credential sharing.
Affected products
- Teledyne FLIR Aware2 through 6.9.0.2 (PackBot) and 1.7.9 (FirstLook)
- Teledyne FLIR PackBot 510
- Teledyne FLIR FirstLook 110
Timeline
- 2026-03-31: disclosed: Initial report to Teledyne
- 2026-06-10: other: Call with Teledyne leadership
- 2026-06-30: other: Call with Teledyne engineering staff
- 2026-09-30: other: Remediation guidance available
- 2026-10-01: advisory: Mandiant advisory published