Vendor
SICK
116 known vulnerabilities.
Products
15 results · Clear filters · Feed
-
Critical 9.4
CVE-2026-11841
An attacker may perform unauthenticated read and write operations on sensitive filesystem areas via the AppEngine Fileaccess over HTTP due to improper access restrictions. A critical filesystem directory was unintentionally exposed through the HTTP-based file…
-
Critical 9.8
CVE-2026-2331
An attacker may perform unauthenticated read and write operations on sensitive filesystem areas via the AppEngine Fileaccess over HTTP due to improper access restrictions. A critical filesystem directory was unintentionally exposed through the HTTP-based file…
-
Critical 9.4
CVE-2026-2330
An attacker may access restricted filesystem areas on the device via the CROWN REST interface due to incomplete whitelist enforcement. Certain directories intended for internal testing were not covered by the whitelist and are accessible without authenticatio…
-
Critical 9.1
Uploading unvalidated container images may allow remote attackers to gain full access to the system, potentially compro…
-
Critical 9.9
An attacker may gain unauthorized access to the host filesystem, potentially allowing them to read and modify system da…
-
Critical 9.8
Weak hashing alghrythm
The device uses a weak hashing alghorithm to create the password hash. Hence, a matching password can be easily calculated by an attacker. This impacts the security and the integrity of the device.
-
Critical 9.3
RCE due to Device Driver
The product can be used to distribute malicious code using SDD Device Drivers due to missing download verification checks, leading to code execution on target systems.
-
Critical 9.9
Privilege Escalation in MEAC300
The standard user uses the run as function to start the MEAC applications with administrative privileges. To ensure that the system can startup on its own, the credentials of the administrator were stored. Consequently, the EPC2 user can execute any command w…
-
Critical 9.0
SICK InspectorP61x, SICK InspectorP62x and SICK TiM3xx are vulnerable for pass-the-hash attacks
The product is vulnerable to pass-the-hash attacks in combination with hardcoded credentials of hidden user levels. This means that an attacker can log in with the hidden user levels and gain full access to the device.
-
Critical 9.1
Vulnerability in SICK CLV6xx, SICK Lector6xx and SICK RFx6xx
A vulnerability in the .sdd file allows an attacker to read default passwords stored in plain text within the code. By exploiting these plaintext credentials, an attacker can log into affected SICK products as an “Authorized Client” if the customer has not ch…
-
Critical 9.8
A remote unauthorized attacker may connect to the SIM1012, interact with the device and change configuration settings. …
-
Critical 9.8
A remote unprivileged attacker can intercept the communication via e.g. Man-In-The-Middle, due to the absence of Transp…
-
Critical 9.8
The LMS5xx uses hard-coded credentials, which potentially allow low-skilled unauthorized remote attackers to reconfigur…
-
Critical 9.8
A remote unprivileged attacker can modify and access configuration settings on the EventCam App due to the absence of A…
-
Critical 9.8
A remote unprivileged attacker can intercept the communication via e.g. Man-In-The-Middle, due to the absence of Transp…