Skip to content
OpenAdvisories
Critical 1 exploited CVE SCA-2026-0017 1 CVE

SICK Products affected by Brotli Vulnerability (Broccoli2Shell)

Published Nov 6, 2026 · Updated Nov 6, 2026

Vendor: SICK Product: Baggage Analytics Product: CorivaHub Product: Logistics Diagnostic Analytics Product: Package Analytics Product: Tire Analytics

Summary

SICK identified multiple products affected by the Brotli vulnerability, also known as Broccoli2Shell (CVE-2026-111497). Successful exploitation of this vulnerability could impact the confidentiality, integrity, and availability of affected systems. At the time of publication, SICK is not aware of any active exploitation of this vulnerability targeting SICK products. SICK strongly recommends that customers review and implement the remediation measures provided in this advisory to reduce potential security risks.

Details

Impact
If exploited, the vulnerability could potentially allow an unauthenticated attacker to compromise the availability, integrity, and confidentiality of the product.

Mitigation
As general security measures, SICK recommends minimizing network exposure of the devices, restricting network access, and following recommended security practices in order to operate the devices in a protected IT environment.

Remediation
SICK recommends updating the product to the fixed version and ensuring that the product operates within a secure environment.

Vulnerabilities 1

  • Critical 9.2
    CVE-2026-111497 Exploited Public exploit EPSS 83%

    Out-of-Bounds Write in Google Brotli Decoder

    A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause …

    Google Brotli firefox open-webui Debian Ubuntu Azure Linux Alpine Wolfi PyPI Go Hex
    KEV Oct 27, 2026

Revision history

  1. #1

    Initial version

References