The vulnerability identified as CVE-2026-14984 involves the cleartext transmission of sensitive data in the primary control endpoints of Teledyne FLIR Aware2 software versions up to 6.9.0.2. Because the data is transmitted without encryption, remote attackers without authentication can intercept or manipulate session traffic directed at Teledyne FLIR PackBot robots. This exposure arises from improper handling of sensitive information over the network, classified under CWE-319.

Exploitation of this vulnerability could allow remote attackers to intercept, hijack, or modify control sessions with Teledyne FLIR PackBot robots. This compromises confidentiality, integrity, and availability of the session traffic, potentially leading to unauthorized control or data leakage. The CVSS 4.0 score of 9.4 reflects the critical nature of this risk with high impact on all security properties and no required privileges or user interaction.

No patch or official fix information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, network-level protections such as encryption tunnels (e.g., VPNs) or network segmentation may reduce exposure but are not a substitute for a proper fix.