CVE-2026-14984 Cleartext HTTP for Control Traffic in Teledyne FLIR Robots running Aware2
Remote attackers can intercept or modify unencrypted control traffic for Teledyne FLIR PackBot robots, risking session hijacking and data exposure.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-14984?
CVE-2026-14984 is a critical vulnerability in Teledyne FLIR Aware2, published on 1 Oct 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Cleartext transmission in the primary control endpoints of Teledyne FLIR Aware2 versions through 6.9.0.2 allows remote unauthenticated attackers to intercept, hijack, or modify session traffic against Teledyne FLIR PackBot robots running this software via sniffing or hijacking network traffic.
Weakness: CWE-319
Which versions are affected by CVE-2026-14984?
How do I fix CVE-2026-14984?
No fix has been published for CVE-2026-14984 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-14984 being exploited?
There is no known exploitation of CVE-2026-14984 in the wild and no public exploit code.
Sources
Also known as GHSA-qx8v-m72v-pf53.