SCA-2026-0016

Vulnerability from csaf_sick - Published: 2026-10-16 11:01 - Updated: 2026-10-16 11:01
Summary
Vulnerabilities Affecting SICK CorivaHub
Notes
summary: SICK CorivaHub includes the third-party components Apache Tomcat and MapLibre GL, which are affected by two known vulnerabilities. These vulnerabilities include an improper input validation issue in Apache Tomcat and a vulnerability in MapLibre GL that could allow malicious behavior through custom GUIs. Under certain conditions, successful exploitation could affect the confidentiality, integrity and availability of the affected system. The attack surface associated with the Apache Tomcat vulnerability is significantly reduced by the default product configuration. Nevertheless, SICK recommends updating to CorivaHub 2026.1.2 to remediate both vulnerabilities.
General Security Measures: As general security measures, SICK recommends minimizing network exposure of the devices, restricting network access and following recommended security practices in order to run the devices in a protected IT environment.
Vulnerability Classification: SICK performs vulnerability classification by using the CVSS scoring system (*CVSS v3.1*). The environmental score is dependent on the customer’s environment and can affect the overall CVSS score. SICK recommends that customers individually evaluate the environmental score to achieve final scoring.
CVE-2026-65637
9.8 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CWE-20 - Improper Input Validation
Affected products
Product Identifier Version Remediation
SICK CorivaHub 2026.1.2
SICK AG / Localization systems / CorivaHub
 2026.1.2
Product Identifier Version Remediation
SICK CorivaHub <=2026.1.1
SICK AG / Localization systems / CorivaHub
 <=2026.1.1
Vendor Fix
Product Identifier Version Remediation
SICK CorivaHub 2026.1.2
SICK AG / Localization systems / CorivaHub
 2026.1.2
CVE-2026-85061
10 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N
CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products
Fixed 1 product, the same list as for CVE-2026-65637
Known affected 1 product, the same list as for CVE-2026-65637
Recommended 1 product, the same list as for CVE-2026-65637
References
To clipboard 

{
  "document": {
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en-US",
    "notes": [
      {
        "category": "summary",
        "text": "SICK CorivaHub includes the third-party components Apache Tomcat and MapLibre GL, which are affected by two known vulnerabilities. These vulnerabilities include an improper input validation issue in Apache Tomcat and a vulnerability in MapLibre GL that could allow malicious behavior through custom GUIs. Under certain conditions, successful exploitation could affect the confidentiality, integrity and availability of the affected system. The attack surface associated with the Apache Tomcat vulnerability is significantly reduced by the default product configuration. Nevertheless, SICK recommends updating to CorivaHub 2026.1.2 to remediate both vulnerabilities. ",
        "title": "summary"
      },
      {
        "category": "general",
        "text": "As general security measures, SICK recommends minimizing network exposure of the devices, restricting network access and following recommended security practices in order to run the devices in a protected IT environment.",
        "title": "General Security Measures"
      },
      {
        "category": "general",
        "text": "SICK performs vulnerability classification by using the CVSS scoring system (*CVSS v3.1*). The environmental score is dependent on the customer\u2019s environment and can affect the overall CVSS score. SICK recommends that customers individually evaluate the environmental score to achieve final scoring.",
        "title": "Vulnerability Classification"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "psirt@sick.de",
      "issuing_authority": "SICK AG issues and issues in EHS products (when related to the Endress+Hauser SICK (EHS) joint venture).",
      "name": "SICK PSIRT",
      "namespace": "https://www.sick.com/psirt"
    },
    "references": [
      {
        "summary": "SICK PSIRT Security Advisories",
        "url": "https://www.sick.com/psirt"
      },
      {
        "summary": "SICK Operating Guidelines",
        "url": "https://www.sick.com/media/docs/9/19/719/special_information_sick_operating_guidelines_cybersecurity_by_sick_en_im0106719.pdf"
      },
      {
        "summary": "ICS-CERT recommended practices on Industrial Security",
        "url": "https://www.cisa.gov/resources-tools/resources/ics-recommended-practices"
      },
      {
        "summary": "CVSS v3.1 Calculator",
        "url": "https://www.first.org/cvss/calculator/3.1"
      },
      {
        "category": "self",
        "summary": "The canonical URL.",
        "url": "https://www.sick.com/.well-known/csaf/white/2026/sca-2026-0016.json"
      },
      {
        "summary": "CorivaHub documentation",
        "url": "https://portal.coriva.io/portal/app/hub-docs?s=main%252F2026.1%252Fdeployment%252Fcluster%252Fconfig-values.html%2523_tile_server"
      }
    ],
    "title": "Vulnerabilities Affecting SICK CorivaHub",
    "tracking": {
      "current_release_date": "2026-10-16T11:01:00.000Z",
      "generator": {
        "date": "2026-10-08T08:44:07.203Z",
        "engine": {
          "name": "Secvisogram",
          "version": "2.6.13"
        }
      },
      "id": "sca-2026-0016",
      "initial_release_date": "2026-10-16T11:01:00.000Z",
      "revision_history": [
        {
          "date": "2026-10-16T11:01:00.000Z",
          "number": "1",
          "summary": "Initial version"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "branches": [
                  {
                    "category": "product_version_range",
                    "name": "\u003c=2026.1.1",
                    "product": {
                      "name": "SICK CorivaHub \u003c=2026.1.1",
                      "product_id": "CSAFPID-51000"
                    }
                  },
                  {
                    "category": "product_version",
                    "name": "2026.1.2",
                    "product": {
                      "name": "SICK CorivaHub 2026.1.2",
                      "product_id": "CSAFPID-52000"
                    }
                  }
                ],
                "category": "product_name",
                "name": "CorivaHub"
              }
            ],
            "category": "product_family",
            "name": "Localization systems"
          }
        ],
        "category": "vendor",
        "name": "SICK AG"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-65637",
      "cwe": {
        "id": "CWE-20",
        "name": "Improper Input Validation"
      },
      "notes": [
        {
          "audience": "all",
          "category": "summary",
          "text": "Improper Input Validation vulnerability in Apache Tomcat due to incomplete fix for CVE-2026-32990. This issue affects Apache Tomcat: from 11.0.20 through 11.0.24, from 10.1.53 through 10.1.57, from 9.0.115 through 9.0.120. Users are recommended to upgrade to version 11.0.25, 10.1.58 or 9.0.121, which fix the issue.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "fixed": [
          "CSAFPID-52000"
        ],
        "known_affected": [
          "CSAFPID-51000"
        ],
        "recommended": [
          "CSAFPID-52000"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-28T15:00:00.000Z",
          "details": "Users are recommended to upgrade to version 2026.1.2.",
          "product_ids": [
            "CSAFPID-51000"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "environmentalScore": 9.8,
            "environmentalSeverity": "CRITICAL",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "temporalScore": 9.8,
            "temporalSeverity": "CRITICAL",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-51000"
          ]
        }
      ],
      "title": "CVE-2026-65637"
    },
    {
      "cve": "CVE-2026-85061",
      "cwe": {
        "id": "CWE-79",
        "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
      },
      "notes": [
        {
          "audience": "all",
          "category": "summary",
          "text": "MapLibre GL JS is an interactive vector tile map library for web browsers. Prior to 6.4.1, DOM.sanitize() in src/util/dom.ts iterates elem.attributes as a live NamedNodeMap while removeAttributes() removes attributes from the same collection, shifting indexes and skipping an adjacent dangerous attribute. An attacker who controls untrusted third-party style attribution strings or user-supplied custom attributions can supply consecutive dangerous attributes, causing an attribute such as onload or ontoggle to survive sanitization and execute when the attribution control inserts the content into innerHTML. A victim must render the affected map content for the script to execute. This issue is fixed in version 6.4.1.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "fixed": [
          "CSAFPID-52000"
        ],
        "known_affected": [
          "CSAFPID-51000"
        ],
        "recommended": [
          "CSAFPID-52000"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-28T15:00:00.000Z",
          "details": "Users are recommended to upgrade to version 2026.1.2.",
          "product_ids": [
            "CSAFPID-51000"
          ]
        },
        {
          "category": "workaround",
          "details": "Customers may disable the offline map functionality by setting corivaHubOfflineMap.enabled to false in the CorivaHub configuration. This prevents the affected MapLibre GL component from being loaded and mitigates the vulnerability. The workaround is not expected to have a significant impact on normal production operations. Detailed configuration instructions are available in the CorivaHub documentation:\nhttps://portal.coriva.io/portal/app/hub-docs?s=main%252F2026.1%252Fdeployment%252Fcluster%252Fconfig-values.html%2523_tile_server",
          "product_ids": [
            "CSAFPID-51000"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 10,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "environmentalScore": 10,
            "environmentalSeverity": "CRITICAL",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "temporalScore": 10,
            "temporalSeverity": "CRITICAL",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-51000"
          ]
        }
      ],
      "title": "CVE-2026-85061"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.

Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

JSON

Loading timeline…




    Related by attack behaviour

    Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.