Vulnerability-Lookup

CVE-2026-11841 (GCVE-0-2026-11841)

Vulnerability from cvelistv5 – Published: 2026-07-28 09:25 – Updated: 2026-07-28 19:15

Title

CVE-2026-11841

Summary

An attacker may perform unauthenticated read and write operations on sensitive filesystem areas via the AppEngine Fileaccess over HTTP due to improper access restrictions. A critical filesystem directory was unintentionally exposed through the HTTP-based file access feature, allowing access without authentication. This includes device parameter files, enabling an attacker to read and modify application settings, including customer-defined passwords. Additionally, exposure of the custom application directory may allow execution of arbitrary Lua code within the sandboxed AppEngine environment.

Severity

9.4 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L

SSVC

Exploitation: none Automatable: yes Technical Impact: total

CISA Coordinator (v2.0.3)

CWE

CWE-552 - Files or directories accessible to external parties

Assigner

SICK AG

References

6 references

URL	Tags
https://www.sick.com/psirt	x_SICK PSIRT Security Advisories
https://www.sick.com/media/docs/9/19/719/special_…	x_SICK Operating Guidelines
https://www.cisa.gov/resources-tools/resources/ic…	x_ICS-CERT recommended practices on Industrial Security
https://www.first.org/cvss/calculator/3.1	x_CVSS v3.1 Calculator
https://www.sick.com/.well-known/csaf/white/2026/…	x_The canonical URL.
https://www.sick.com/.well-known/csaf/white/2026/…	vendor-advisory

Impacted products

5 products

Vendor	Product	Version
SICK AG	InspectorP61x	Affected: 0 , < 5.4.0 (custom)
SICK AG	InspectorP62x	Affected: 0 , < 5.4.0 (custom)
SICK AG	InspectorP65x	Affected: all versions
SICK AG	InspectorP63x	Affected: all versions
SICK AG	InspectorP64x	Affected: all versions

Date Public

2026-07-28 10:47

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-11841",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-28T19:13:27.519553Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-28T19:15:14.851Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "affected",
          "product": "InspectorP61x",
          "vendor": "SICK AG",
          "versions": [
            {
              "lessThan": "5.4.0",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "InspectorP62x",
          "vendor": "SICK AG",
          "versions": [
            {
              "lessThan": "5.4.0",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "InspectorP65x",
          "vendor": "SICK AG",
          "versions": [
            {
              "status": "affected",
              "version": "all versions"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "InspectorP63x",
          "vendor": "SICK AG",
          "versions": [
            {
              "status": "affected",
              "version": "all versions"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "InspectorP64x",
          "vendor": "SICK AG",
          "versions": [
            {
              "status": "affected",
              "version": "all versions"
            }
          ]
        }
      ],
      "datePublic": "2026-07-28T10:47:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eAn attacker may perform unauthenticated read and write operations on sensitive filesystem areas via the AppEngine Fileaccess over HTTP due to improper access restrictions. A critical filesystem directory was unintentionally exposed through the HTTP-based file access feature, allowing access without authentication. This includes device parameter files, enabling an attacker to read and modify application settings, including customer-defined passwords. Additionally, exposure of the custom application directory may allow execution of arbitrary Lua code within the sandboxed AppEngine environment.\u003c/p\u003e"
            }
          ],
          "value": "An attacker may perform unauthenticated read and write operations on sensitive filesystem areas via the AppEngine Fileaccess over HTTP due to improper access restrictions. A critical filesystem directory was unintentionally exposed through the HTTP-based file access feature, allowing access without authentication. This includes device parameter files, enabling an attacker to read and modify application settings, including customer-defined passwords. Additionally, exposure of the custom application directory may allow execution of arbitrary Lua code within the sandboxed AppEngine environment."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 9.4,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-552",
              "description": "CWE-552 Files or directories accessible to external parties",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-28T09:25:36.738Z",
        "orgId": "a6863dd2-93fc-443d-bef1-79f0b5020988",
        "shortName": "SICK AG"
      },
      "references": [
        {
          "tags": [
            "x_SICK PSIRT Security Advisories"
          ],
          "url": "https://www.sick.com/psirt"
        },
        {
          "tags": [
            "x_SICK Operating Guidelines"
          ],
          "url": "https://www.sick.com/media/docs/9/19/719/special_information_sick_operating_guidelines_cybersecurity_by_sick_en_im0106719.pdf"
        },
        {
          "tags": [
            "x_ICS-CERT recommended practices on Industrial Security"
          ],
          "url": "https://www.cisa.gov/resources-tools/resources/ics-recommended-practices"
        },
        {
          "tags": [
            "x_CVSS v3.1 Calculator"
          ],
          "url": "https://www.first.org/cvss/calculator/3.1"
        },
        {
          "tags": [
            "x_The canonical URL."
          ],
          "url": "https://www.sick.com/.well-known/csaf/white/2026/sca-2026-0010.json"
        },
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.sick.com/.well-known/csaf/white/2026/sca-2026-0010.pdf"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cdiv\u003e\u003cspan\u003eInspectorP61x and InspectorP62x u\u003c/span\u003esers are recommended to upgrade to version 5.4.0.\u003c/div\u003e"
            }
          ],
          "value": "InspectorP61x and InspectorP62x users are recommended to upgrade to version 5.4.0."
        }
      ],
      "source": {
        "advisory": "SCA-2026-0010",
        "discovery": "INTERNAL"
      },
      "title": "CVE-2026-11841",
      "workarounds": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cdiv\u003e\u003cdiv\u003ePlease make sure that only trusted entities have access to the device. Furthermore, you should apply the following General Security Measures when operating the product to mitigate the associated security risk. The collected resources \u201dSICK Operating Guidelines\u201d and \u201dICS-CERT recommended practices on Industrial Security\u201d could help to implement the general security practices.\u003c/div\u003e\u003c/div\u003e"
            }
          ],
          "value": "Please make sure that only trusted entities have access to the device. Furthermore, you should apply the following General Security Measures when operating the product to mitigate the associated security risk. The collected resources \u201dSICK Operating Guidelines\u201d and \u201dICS-CERT recommended practices on Industrial Security\u201d could help to implement the general security practices."
        }
      ],
      "x_generator": {
        "engine": "Vulnogram 1.0.4"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a6863dd2-93fc-443d-bef1-79f0b5020988",
    "assignerShortName": "SICK AG",
    "cveId": "CVE-2026-11841",
    "datePublished": "2026-07-28T09:25:36.738Z",
    "dateReserved": "2026-06-10T06:53:18.277Z",
    "dateUpdated": "2026-07-28T19:15:14.851Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-11841",
      "date": "2026-07-29",
      "epss": "0.00458",
      "percentile": "0.3735"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-11841\",\"sourceIdentifier\":\"psirt@sick.de\",\"published\":\"2026-07-28T10:16:47.867\",\"lastModified\":\"2026-07-28T20:17:22.727\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"An attacker may perform unauthenticated read and write operations on sensitive filesystem areas via the AppEngine Fileaccess over HTTP due to improper access restrictions. A critical filesystem directory was unintentionally exposed through the HTTP-based file access feature, allowing access without authentication. This includes device parameter files, enabling an attacker to read and modify application settings, including customer-defined passwords. Additionally, exposure of the custom application directory may allow execution of arbitrary Lua code within the sandboxed AppEngine environment.\"}],\"affected\":[{\"source\":\"psirt@sick.de\",\"affectedData\":[{\"vendor\":\"SICK AG\",\"product\":\"InspectorP61x\",\"defaultStatus\":\"affected\",\"versions\":[{\"version\":\"0\",\"lessThan\":\"5.4.0\",\"versionType\":\"custom\",\"status\":\"affected\"}]},{\"vendor\":\"SICK AG\",\"product\":\"InspectorP62x\",\"defaultStatus\":\"affected\",\"versions\":[{\"version\":\"0\",\"lessThan\":\"5.4.0\",\"versionType\":\"custom\",\"status\":\"affected\"}]},{\"vendor\":\"SICK AG\",\"product\":\"InspectorP65x\",\"defaultStatus\":\"affected\",\"versions\":[{\"version\":\"all versions\",\"status\":\"affected\"}]},{\"vendor\":\"SICK AG\",\"product\":\"InspectorP63x\",\"defaultStatus\":\"affected\",\"versions\":[{\"version\":\"all versions\",\"status\":\"affected\"}]},{\"vendor\":\"SICK AG\",\"product\":\"InspectorP64x\",\"defaultStatus\":\"affected\",\"versions\":[{\"version\":\"all versions\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"psirt@sick.de\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L\",\"baseScore\":9.4,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"LOW\"},\"exploitabilityScore\":3.9,\"impactScore\":5.5}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-07-28T19:13:27.519553Z\",\"id\":\"CVE-2026-11841\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"yes\"},{\"technicalImpact\":\"total\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"psirt@sick.de\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-552\"}]}],\"references\":[{\"url\":\"https://www.cisa.gov/resources-tools/resources/ics-recommended-practices\",\"source\":\"psirt@sick.de\"},{\"url\":\"https://www.first.org/cvss/calculator/3.1\",\"source\":\"psirt@sick.de\"},{\"url\":\"https://www.sick.com/.well-known/csaf/white/2026/sca-2026-0010.json\",\"source\":\"psirt@sick.de\"},{\"url\":\"https://www.sick.com/.well-known/csaf/white/2026/sca-2026-0010.pdf\",\"source\":\"psirt@sick.de\"},{\"url\":\"https://www.sick.com/media/docs/9/19/719/special_information_sick_operating_guidelines_cybersecurity_by_sick_en_im0106719.pdf\",\"source\":\"psirt@sick.de\"},{\"url\":\"https://www.sick.com/psirt\",\"source\":\"psirt@sick.de\"}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-11841\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"yes\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-07-28T19:13:27.519553Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-07-28T19:15:11.703Z\"}}], \"cna\": {\"title\": \"CVE-2026-11841\", \"source\": {\"advisory\": \"SCA-2026-0010\", \"discovery\": \"INTERNAL\"}, \"metrics\": [{\"format\": \"CVSS\", \"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 9.4, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"CRITICAL\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"LOW\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"HIGH\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}], \"affected\": [{\"vendor\": \"SICK AG\", \"product\": \"InspectorP61x\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"5.4.0\", \"versionType\": \"custom\"}], \"defaultStatus\": \"affected\"}, {\"vendor\": \"SICK AG\", \"product\": \"InspectorP62x\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"5.4.0\", \"versionType\": \"custom\"}], \"defaultStatus\": \"affected\"}, {\"vendor\": \"SICK AG\", \"product\": \"InspectorP65x\", \"versions\": [{\"status\": \"affected\", \"version\": \"all versions\"}], \"defaultStatus\": \"affected\"}, {\"vendor\": \"SICK AG\", \"product\": \"InspectorP63x\", \"versions\": [{\"status\": \"affected\", \"version\": \"all versions\"}], \"defaultStatus\": \"affected\"}, {\"vendor\": \"SICK AG\", \"product\": \"InspectorP64x\", \"versions\": [{\"status\": \"affected\", \"version\": \"all versions\"}], \"defaultStatus\": \"affected\"}], \"solutions\": [{\"lang\": \"en\", \"value\": \"InspectorP61x and InspectorP62x users are recommended to upgrade to version 5.4.0.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"\u003cdiv\u003e\u003cspan\u003eInspectorP61x and InspectorP62x u\u003c/span\u003esers are recommended to upgrade to version 5.4.0.\u003c/div\u003e\", \"base64\": false}]}], \"datePublic\": \"2026-07-28T10:47:00.000Z\", \"references\": [{\"url\": \"https://www.sick.com/psirt\", \"tags\": [\"x_SICK PSIRT Security Advisories\"]}, {\"url\": \"https://www.sick.com/media/docs/9/19/719/special_information_sick_operating_guidelines_cybersecurity_by_sick_en_im0106719.pdf\", \"tags\": [\"x_SICK Operating Guidelines\"]}, {\"url\": \"https://www.cisa.gov/resources-tools/resources/ics-recommended-practices\", \"tags\": [\"x_ICS-CERT recommended practices on Industrial Security\"]}, {\"url\": \"https://www.first.org/cvss/calculator/3.1\", \"tags\": [\"x_CVSS v3.1 Calculator\"]}, {\"url\": \"https://www.sick.com/.well-known/csaf/white/2026/sca-2026-0010.json\", \"tags\": [\"x_The canonical URL.\"]}, {\"url\": \"https://www.sick.com/.well-known/csaf/white/2026/sca-2026-0010.pdf\", \"tags\": [\"vendor-advisory\"]}], \"workarounds\": [{\"lang\": \"en\", \"value\": \"Please make sure that only trusted entities have access to the device. Furthermore, you should apply the following General Security Measures when operating the product to mitigate the associated security risk. The collected resources \\u201dSICK Operating Guidelines\\u201d and \\u201dICS-CERT recommended practices on Industrial Security\\u201d could help to implement the general security practices.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"\u003cdiv\u003e\u003cdiv\u003ePlease make sure that only trusted entities have access to the device. Furthermore, you should apply the following General Security Measures when operating the product to mitigate the associated security risk. The collected resources \\u201dSICK Operating Guidelines\\u201d and \\u201dICS-CERT recommended practices on Industrial Security\\u201d could help to implement the general security practices.\u003c/div\u003e\u003c/div\u003e\", \"base64\": false}]}], \"x_generator\": {\"engine\": \"Vulnogram 1.0.4\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"An attacker may perform unauthenticated read and write operations on sensitive filesystem areas via the AppEngine Fileaccess over HTTP due to improper access restrictions. A critical filesystem directory was unintentionally exposed through the HTTP-based file access feature, allowing access without authentication. This includes device parameter files, enabling an attacker to read and modify application settings, including customer-defined passwords. Additionally, exposure of the custom application directory may allow execution of arbitrary Lua code within the sandboxed AppEngine environment.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"\u003cp\u003eAn attacker may perform unauthenticated read and write operations on sensitive filesystem areas via the AppEngine Fileaccess over HTTP due to improper access restrictions. A critical filesystem directory was unintentionally exposed through the HTTP-based file access feature, allowing access without authentication. This includes device parameter files, enabling an attacker to read and modify application settings, including customer-defined passwords. Additionally, exposure of the custom application directory may allow execution of arbitrary Lua code within the sandboxed AppEngine environment.\u003c/p\u003e\", \"base64\": false}]}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-552\", \"description\": \"CWE-552 Files or directories accessible to external parties\"}]}], \"providerMetadata\": {\"orgId\": \"a6863dd2-93fc-443d-bef1-79f0b5020988\", \"shortName\": \"SICK AG\", \"dateUpdated\": \"2026-07-28T09:25:36.738Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-11841\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-07-28T19:15:14.851Z\", \"dateReserved\": \"2026-06-10T06:53:18.277Z\", \"assignerOrgId\": \"a6863dd2-93fc-443d-bef1-79f0b5020988\", \"datePublished\": \"2026-07-28T09:25:36.738Z\", \"assignerShortName\": \"SICK AG\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

GHSA-5X3H-WQ76-MXQX

Vulnerability from github – Published: 2026-07-28 12:31 – Updated: 2026-07-28 12:31

Details

Severity

9.4 (Critical)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2026-11841"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-552"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-07-28T10:16:47Z",
    "severity": "CRITICAL"
  },
  "details": "An attacker may perform unauthenticated read and write operations on sensitive filesystem areas via the AppEngine Fileaccess over HTTP due to improper access restrictions. A critical filesystem directory was unintentionally exposed through the HTTP-based file access feature, allowing access without authentication. This includes device parameter files, enabling an attacker to read and modify application settings, including customer-defined passwords. Additionally, exposure of the custom application directory may allow execution of arbitrary Lua code within the sandboxed AppEngine environment.",
  "id": "GHSA-5x3h-wq76-mxqx",
  "modified": "2026-07-28T12:31:19Z",
  "published": "2026-07-28T12:31:19Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-11841"
    },
    {
      "type": "WEB",
      "url": "https://www.cisa.gov/resources-tools/resources/ics-recommended-practices"
    },
    {
      "type": "WEB",
      "url": "https://www.first.org/cvss/calculator/3.1"
    },
    {
      "type": "WEB",
      "url": "https://www.sick.com/.well-known/csaf/white/2026/sca-2026-0010.json"
    },
    {
      "type": "WEB",
      "url": "https://www.sick.com/.well-known/csaf/white/2026/sca-2026-0010.pdf"
    },
    {
      "type": "WEB",
      "url": "https://www.sick.com/media/docs/9/19/719/special_information_sick_operating_guidelines_cybersecurity_by_sick_en_im0106719.pdf"
    },
    {
      "type": "WEB",
      "url": "https://www.sick.com/psirt"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L",
      "type": "CVSS_V3"
    }
  ]
}

SCA-2026-0010

Vulnerability from csaf_sick - Published: 2026-07-28 12:47 - Updated: 2026-07-28 12:47

Summary

AppEngine vulnerability affects SICK InspectorP6xx devices

Notes

summary: Multiple internal virtual filesystem paths are unintentionally accessible remotely in the SICK InspectorP6xx devices. If exploited, this vulnerability could potentially allow an unauthenticated attacker to compromise the availability, integrity, and confidentiality of the devices.

General Security Measures: As general security measures, SICK recommends minimizing network exposure of the devices, restricting network access and following recommended security practices in order to run the devices in a protected IT environment.

Vulnerability Classification: SICK performs vulnerability classification by using the CVSS scoring system (*CVSS v3.1*). The environmental score is dependent on the customer’s environment and can affect the overall CVSS score. SICK recommends that customers individually evaluate the environmental score to achieve final scoring.

CVE-2026-11841

9.4 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L

CWE-552 - Files or Directories Accessible to External Parties

Affected products

Fixed 2 products

Product	Identifier	Version	Remediation
Unresolved product id: CSAFPID-32000		—
Unresolved product id: CSAFPID-32002		—

Known affected 5 products

Product	Version	Remediation
Unresolved product id: CSAFPID-31000	—	Vendor Fix
Unresolved product id: CSAFPID-31002	—	Vendor Fix
Unresolved product id: CSAFPID-31003	—	Mitigation
Unresolved product id: CSAFPID-31004	—	Mitigation
Unresolved product id: CSAFPID-31005	—	Mitigation

Recommended 2 products

Product	Identifier	Version	Remediation
Unresolved product id: CSAFPID-32000		—
Unresolved product id: CSAFPID-32002		—

References

5 references

URL	Category
https://www.sick.com/psirt
https://www.sick.com/media/docs/9/19/719/special_…
https://www.cisa.gov/resources-tools/resources/ic…
https://www.first.org/cvss/calculator/3.1
https://www.sick.com/.well-known/csaf/white/2026/…	self

JSON

To clipboard

{
  "document": {
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en-US",
    "notes": [
      {
        "category": "summary",
        "text": "Multiple internal virtual filesystem paths are unintentionally accessible remotely in the SICK InspectorP6xx devices. If exploited, this vulnerability could potentially allow an unauthenticated attacker to compromise the availability, integrity, and confidentiality of the devices.",
        "title": "summary"
      },
      {
        "category": "general",
        "text": "As general security measures, SICK recommends minimizing network exposure of the devices, restricting network access and following recommended security practices in order to run the devices in a protected IT environment.",
        "title": "General Security Measures"
      },
      {
        "category": "general",
        "text": "SICK performs vulnerability classification by using the CVSS scoring system (*CVSS v3.1*). The environmental score is dependent on the customer\u2019s environment and can affect the overall CVSS score. SICK recommends that customers individually evaluate the environmental score to achieve final scoring.",
        "title": "Vulnerability Classification"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "psirt@sick.de",
      "issuing_authority": "SICK AG issues and issues in EHS products (when related to the Endress+Hauser SICK (EHS) joint venture).",
      "name": "SICK PSIRT",
      "namespace": "https://www.sick.com/psirt"
    },
    "references": [
      {
        "summary": "SICK PSIRT Security Advisories",
        "url": "https://www.sick.com/psirt"
      },
      {
        "summary": "SICK Operating Guidelines",
        "url": "https://www.sick.com/media/docs/9/19/719/special_information_sick_operating_guidelines_cybersecurity_by_sick_en_im0106719.pdf"
      },
      {
        "summary": "ICS-CERT recommended practices on Industrial Security",
        "url": "https://www.cisa.gov/resources-tools/resources/ics-recommended-practices"
      },
      {
        "summary": "CVSS v3.1 Calculator",
        "url": "https://www.first.org/cvss/calculator/3.1"
      },
      {
        "category": "self",
        "summary": "The canonical URL.",
        "url": "https://www.sick.com/.well-known/csaf/white/2026/sca-2026-0008.json"
      }
    ],
    "title": "AppEngine vulnerability affects SICK InspectorP6xx devices",
    "tracking": {
      "current_release_date": "2026-07-28T12:47:00.000Z",
      "generator": {
        "date": "2026-07-20T12:30:23.840Z",
        "engine": {
          "name": "Secvisogram",
          "version": "2.6.6"
        }
      },
      "id": "sca-2026-0010",
      "initial_release_date": "2026-07-28T12:47:00.000Z",
      "revision_history": [
        {
          "date": "2026-07-28T12:47:00.000Z",
          "number": "1",
          "summary": "Initial version"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "branches": [
                  {
                    "category": "product_version_range",
                    "name": "vers:all/*",
                    "product": {
                      "name": "SICK InspectorP61x all versions",
                      "product_id": "CSAFPID-11000",
                      "product_identification_helper": {
                        "skus": [
                          "1124942",
                          "1124949",
                          "1124943",
                          "1124948",
                          "1142000",
                          "1124947",
                          "1142001",
                          "1124946",
                          "1143233",
                          "1143232",
                          "1114809",
                          "1116350"
                        ]
                      }
                    }
                  }
                ],
                "category": "product_name",
                "name": "InspectorP61x"
              },
              {
                "branches": [
                  {
                    "category": "product_version_range",
                    "name": "vers:all/*",
                    "product": {
                      "name": "SICK InspectorP62x all versions",
                      "product_id": "CSAFPID-11001",
                      "product_identification_helper": {
                        "skus": [
                          "1111871",
                          "1110848",
                          "1130942",
                          "1154202",
                          "1110849",
                          "1111870",
                          "1110847",
                          "1154203",
                          "1121695",
                          "1121694",
                          "1156218",
                          "1118465",
                          "1118466",
                          "1156219"
                        ]
                      }
                    }
                  }
                ],
                "category": "product_name",
                "name": "InspectorP62x"
              },
              {
                "branches": [
                  {
                    "category": "product_version_range",
                    "name": "vers:all/*",
                    "product": {
                      "name": "SICK InspectorP65x all versions",
                      "product_id": "CSAFPID-11002",
                      "product_identification_helper": {
                        "skus": [
                          "1073669",
                          "1073670",
                          "1082303",
                          "1082304",
                          "1082305",
                          "1082306"
                        ]
                      }
                    }
                  }
                ],
                "category": "product_name",
                "name": "InspectorP65x"
              },
              {
                "branches": [
                  {
                    "category": "product_version_range",
                    "name": "vers:all/*",
                    "product": {
                      "name": "SICK InspectorP63x all versions",
                      "product_id": "CSAFPID-11003",
                      "product_identification_helper": {
                        "skus": [
                          "1082298",
                          "1082299",
                          "1082300",
                          "1082301",
                          "1101157",
                          "1101640"
                        ]
                      }
                    }
                  }
                ],
                "category": "product_name",
                "name": "InspectorP63x"
              },
              {
                "branches": [
                  {
                    "category": "product_version_range",
                    "name": "vers:all/*",
                    "product": {
                      "name": "SICK InspectorP64x all versions",
                      "product_id": "CSAFPID-11004",
                      "product_identification_helper": {
                        "skus": [
                          "1075507",
                          "1082302"
                        ]
                      }
                    }
                  }
                ],
                "category": "product_name",
                "name": "InspectorP64x"
              }
            ],
            "category": "product_family",
            "name": "Inspector"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c 5.4.0",
                "product": {
                  "name": "SICK InspectorP61x firmware \u003c 5.4.0",
                  "product_id": "CSAFPID-21000"
                }
              },
              {
                "category": "product_version",
                "name": "5.4.0",
                "product": {
                  "name": "SICK InspectorP61x firmware 5.4.0",
                  "product_id": "CSAFPID-22000"
                }
              }
            ],
            "category": "product_name",
            "name": "InspectorP61x firmware"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c 5.4.0",
                "product": {
                  "name": "SICK InspectorP62x firmware \u003c 5.4.0",
                  "product_id": "CSAFPID-21002"
                }
              },
              {
                "category": "product_version",
                "name": "5.4.0",
                "product": {
                  "name": "SICK InspectorP62x firmware 5.4.0",
                  "product_id": "CSAFPID-22002"
                }
              }
            ],
            "category": "product_name",
            "name": "InspectorP62x firmware"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:all/*",
                "product": {
                  "name": "SICK InspectorP65x firmware all versions",
                  "product_id": "CSAFPID-21003"
                }
              }
            ],
            "category": "product_name",
            "name": "InspectorP65x firmware"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:all/*",
                "product": {
                  "name": "SICK InspectorP63x firmware all versions",
                  "product_id": "CSAFPID-21004"
                }
              }
            ],
            "category": "product_name",
            "name": "InspectorP63x firmware"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:all/*",
                "product": {
                  "name": "SICK InspectorP64x firmware all versions",
                  "product_id": "CSAFPID-21005"
                }
              }
            ],
            "category": "product_name",
            "name": "InspectorP64x firmware"
          }
        ],
        "category": "vendor",
        "name": "SICK AG"
      }
    ],
    "relationships": [
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "SICK InspectorP61x with firmware \u003c 5.4.0",
          "product_id": "CSAFPID-31000"
        },
        "product_reference": "CSAFPID-21000",
        "relates_to_product_reference": "CSAFPID-11000"
      },
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "SICK InspectorP62x with firmware \u003c 5.4.0",
          "product_id": "CSAFPID-31002"
        },
        "product_reference": "CSAFPID-21002",
        "relates_to_product_reference": "CSAFPID-11001"
      },
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "SICK InspectorP65x all firmware versions",
          "product_id": "CSAFPID-31003"
        },
        "product_reference": "CSAFPID-21003",
        "relates_to_product_reference": "CSAFPID-11002"
      },
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "SICK InspectorP63x all firmware versions",
          "product_id": "CSAFPID-31004"
        },
        "product_reference": "CSAFPID-21004",
        "relates_to_product_reference": "CSAFPID-11003"
      },
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "SICK InspectorP64x all firmware versions",
          "product_id": "CSAFPID-31005"
        },
        "product_reference": "CSAFPID-21005",
        "relates_to_product_reference": "CSAFPID-11004"
      },
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "SICK InspectorP61x with firmware 5.4.0",
          "product_id": "CSAFPID-32000"
        },
        "product_reference": "CSAFPID-22000",
        "relates_to_product_reference": "CSAFPID-11000"
      },
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "SICK InspectorP62x with firmware 5.4.0",
          "product_id": "CSAFPID-32002"
        },
        "product_reference": "CSAFPID-22002",
        "relates_to_product_reference": "CSAFPID-11001"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-11841",
      "cwe": {
        "id": "CWE-552",
        "name": "Files or Directories Accessible to External Parties"
      },
      "notes": [
        {
          "audience": "all",
          "category": "summary",
          "text": "A vulnerability has been identified in the SOPAS FileSystemAccess method that allows unintended remote access to internal virtual filesystem paths. Due to insufficient access restrictions, an attacker with network access can query and modify internal storage locations, configuration files, and system-related application directories. This exposure may lead to the Denial of Service, unauthorized change of device configuration or disclosure of sensitive system information that could facilitate further attacks or compromise of the device.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "fixed": [
          "CSAFPID-32000",
          "CSAFPID-32002"
        ],
        "known_affected": [
          "CSAFPID-31000",
          "CSAFPID-31002",
          "CSAFPID-31003",
          "CSAFPID-31004",
          "CSAFPID-31005"
        ],
        "recommended": [
          "CSAFPID-32000",
          "CSAFPID-32002"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-06-17T12:47:21.218Z",
          "details": "Users are recommended to upgrade to version 5.4.0.",
          "product_ids": [
            "CSAFPID-31000",
            "CSAFPID-31002"
          ]
        },
        {
          "category": "mitigation",
          "date": "2026-06-17T12:47:21.218Z",
          "details": "Please make sure that only trusted entities have access to the device. Furthermore, you should apply the following General Security Measures when operating the product to mitigate the associated security risk. The collected resources \u201dSICK Operating Guidelines\u201d and \u201dICS-CERT recommended practices on Industrial Security\u201d could help to implement the general security practices.",
          "product_ids": [
            "CSAFPID-31003",
            "CSAFPID-31004",
            "CSAFPID-31005"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 9.4,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "environmentalScore": 9.4,
            "environmentalSeverity": "CRITICAL",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "temporalScore": 9.4,
            "temporalSeverity": "CRITICAL",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-31000",
            "CSAFPID-31002",
            "CSAFPID-31003",
            "CSAFPID-31004",
            "CSAFPID-31005"
          ]
        }
      ],
      "title": "CVE-2026-11841"
    }
  ]
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.

Action not permitted

CVE-2026-11841 (GCVE-0-2026-11841)

GHSA-5X3H-WQ76-MXQX

SCA-2026-0010

Tags

Sightings

Nomenclature