Vulnerabilities affecting SICK Incoming Goods Suite
SICK has identified multiple vulnerabilities in the SICK Incoming Goods Suite product. Vulnerabilities related to Grafana apply exclusively to the administrative user interface for log management and do not affect the Incoming Goods Suite user interface. The vulnerabilities could potentially affect the confidentiality, integrity an availability of the product. Therefore it is strongly recommended to apply general security practices when operating the product.
beschreibt (12)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2026-22646US | high7.5 | — | ||
Certain error messages returned by the application expose internal system details that should not be visible to end users, providing attackers with valuable reconnaissance informat… | ||||
| CVE-2026-22645US | — | — | ||
The application discloses all used components, versions and license information to unauthenticated actors, giving attackers the opportunity to target known security vulnerabilities… | ||||
| CVE-2026-22644US | high7.5 | — | ||
Certain requests pass the authentication token in the URL as string query parameter, making it vulnerable to theft through server logs, proxy logs and Referer headers, which could… | ||||
| CVE-2025-6197US | — | — | ||
An open redirect vulnerability has been identified in Grafana OSS organization switching functionality.
Prerequisites for exploitation:
- Multiple organizations must exist in th… | ||||
| CVE-2025-6023US | — | — | ||
An open redirect vulnerability has been identified in Grafana OSS that can be exploited to achieve XSS attacks. The vulnerability was introduced in Grafana v11.5.0.
The open redir… | ||||
| CVE-2025-3415US | — | — | ||
Grafana is an open-source platform for monitoring and observability. The Grafana Alerting DingDing integration was not properly protected and could be exposed to users with Viewer… | ||||
| CVE-2025-1088US | — | — | ||
In Grafana, an excessively long dashboard title or panel name will cause Chromium browsers to become unresponsive due to Improper Input Validation vulnerability in Grafana.
This is… | ||||
| CVE-2025-3454US | — | — | ||
This vulnerability in Grafana's datasource proxy API allows authorization checks to be bypassed by adding an extra slash character in the URL path.
Users with minimal permissions… | ||||
| CVE-2025-3260US | —OT erhöht | — | ||
A security vulnerability in the /apis/dashboard.grafana.app/* endpoints allows authenticated users to bypass dashboard and folder permissions. The vulnerability affects all API ver… | ||||
| CVE-2025-3580US | — | — | ||
An access control vulnerability was discovered in Grafana OSS where an Organization administrator could permanently delete the Server administrator account. This vulnerability exis… | ||||
| CVE-2025-4123US | medium6.1 | Exploit | ||
A cross-site scripting (XSS) vulnerability exists in Grafana caused by combining a client path traversal and open redirect. This allows attackers to redirect users to a website tha… | ||||
| CVE-2025-2703US | — | — | ||
The built-in XY Chart plugin is vulnerable to a DOM XSS vulnerability.
A user with Editor permissions is able to modify such a panel in order to make it execute arbitrary JavaScr… | ||||
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
Behebungen (12)
- MitigationSICK Incoming Goods Suite all Firmware versions
Please make sure that logs exclude informative level and are stored in a secure way. For more information please follow the official Microsoft Security Considerations document for .NET: https://learn.microsoft.com/en-us/aspnet/core/signalr/security?view=aspnetcore-9.0#access-token-logging Please make sure that only trusted entities have access to the device. Furthermore, you should apply the following General Security Measures when operating the product to mitigate the associated security risk. The collected resources ”SICK Operating Guidelines” and ”ICS-CERT recommended practices on Industrial Security” could help to implement the general security practices.
- BehobenSICK Incoming Goods Suite with Firmware <1.2.1
Users are strongly recommended to upgrade to the latest release of Incoming Goods Suite (>= 1.2.1).
- BehobenSICK Incoming Goods Suite with Firmware <1.2.1
Users are strongly recommended to upgrade to the latest release of Incoming Goods Suite (>= 1.2.1).
- BehobenSICK Incoming Goods Suite with Firmware <1.2.1
Users are strongly recommended to upgrade to the latest release of Incoming Goods Suite (>= 1.2.1).
- BehobenSICK Incoming Goods Suite with Firmware <1.2.1
Users are strongly recommended to upgrade to the latest release of Incoming Goods Suite (>= 1.2.1).
- BehobenSICK Incoming Goods Suite with Firmware <1.2.1
Users are strongly recommended to upgrade to the latest release of Incoming Goods Suite (>= 1.2.1).
- BehobenSICK Incoming Goods Suite with Firmware <1.2.1
Users are strongly recommended to upgrade to the latest release of Incoming Goods Suite (>= 1.2.1).
- BehobenSICK Incoming Goods Suite with Firmware <1.2.1
Users are strongly recommended to upgrade to the latest release of Incoming Goods Suite (>= 1.2.1).
- BehobenSICK Incoming Goods Suite with Firmware <1.2.1
Users are strongly recommended to upgrade to the latest release of Incoming Goods Suite (>= 1.2.1).
- BehobenSICK Incoming Goods Suite with Firmware <1.2.1
Users are strongly recommended to upgrade to the latest release of Incoming Goods Suite (>= 1.2.1).
- BehobenSICK Incoming Goods Suite with Firmware <1.2.1
Users are strongly recommended to upgrade to the latest release of Incoming Goods Suite (>= 1.2.1).
- BehobenSICK Incoming Goods Suite with Firmware <1.2.1
Users are strongly recommended to upgrade to the latest release of Incoming Goods Suite (>= 1.2.1).
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan