CVE-2026-2331

criticalPriorität · verfolgen · 0EPSS 0.009 · 60. PerzentilDEEU

grimoire priorityP2 · Scheduled

Exploitable?

—

no known exploitation

Likely / severe?

0.92% (60th) EPSS

CVSS 9.8 · critical

Is it mine?

6 products

Prüfe deine Angriffsfläche

Who says so?

3 sources

cnnvd · enisa_euvd · sick_psirt

EPSS · bewertet 2026-10-23

An attacker may perform unauthenticated read and write operations on sensitive filesystem areas via the AppEngine Fileaccess over HTTP due to improper access restrictions. A critical filesystem directory was unintentionally exposed through the HTTP-based file access feature, allowing access without authentication. This includes device parameter files, enabling an attacker to read and modify application settings, including customer-defined passwords. Additionally, exposure of the custom application directory may allow execution of arbitrary Lua code within the sandboxed AppEngine environment.

Behebungen

Hersteller-Fix, Mitigation oder Workaround, wie von den Quellen veröffentlicht.

Ein Hersteller-Fix ist verfügbar.

BehobenSICK Lector83x with firmware >= 2.6.0 <= 2.7.0sick_psirt
Users are strongly recommended to upgrade to release version 2.8.0.
BehobenSICK Lector85x with firmware >= 2.6.0 <= 2.7.0sick_psirt
Users are strongly recommended to upgrade to release version 2.8.0.

cvss

Technischer Schweregrad, 0–10. Eine Zeile je Quelle.

9.8

010

Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen

v3.19.8criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hsecondary · ENISA EU

v3.19.8criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hsecondary · psirt@sick.deAusnutzbarkeit 3.9 · Auswirkung 5.9

v3.19.8criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hsecondary · SICK PSIRT DE

v3.19criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:Usecondary · CVSS-BT (t0sche)

SSVC

Eine Handlungsentscheidung — aus Ausnutzung und Auswirkung.

Exploitation: none · Automatable: yes · Technical Impact: totalcoordinatorcisa_ssvcUS

schwächen

Die CWE-Schwächeklassen, zu denen dies gehört.

CWE-552USCWE-552US

betroffene Produkte (6)

Betroffene Produkte und Versionsbereiche.

SICK AG SICK Lector83x≤ 2.6.0 ≤2.7.0enisa_euvdEU
SICK AG SICK Lector85x≤ 2.6.0 ≤2.7.0enisa_euvdEU
SICK Lector83x with firmware 2.8.0alle Versionenfixedsick_psirtDE
SICK Lector83x with firmware >= 2.6.0 <= 2.7.0alle Versionensick_psirtDE
SICK Lector85x with firmware 2.8alle Versionenfixedsick_psirtDE
SICK Lector85x with firmware >= 2.6.0 <= 2.7.0alle Versionensick_psirtDE

Advisories (1)

Hersteller- und Ökosystem-Meldungen dazu.

SCA-2026-0006Vulnerabilities affecting SICK Lector85x and SICK Lector83x2026-03-06csaf · sick_psirtDE
Two vulnerabilities affecting the SICK Lector85x and SICK Lector83x product families have been identified. Both vulnerabilities are caused by insufficient access restrictions in HTTP-based interfaces, which may allow unauthenticated access to sensitive device resources. Depending on the configuration, this could lead to unauthorized modification of device settings and security-relevant data. SICK recommends applying the defined remediations for both vulnerabilities. SICK is currently not aware of any public exploits.

auch bekannt als (3)

Weitere Namen und Kennungen dieser Entität.

quellen

Welche Quellen diesen Datensatz belegen und wann.

cnnvd enisa_euvd sick_psirt NVD CVE.org MITRE

veröffentlicht 2026-03-06geändert 2026-06-17

Referenzen (19)

Externe Belege — Patches, Meldungen, Analysen.

scry

Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.

Kostenloser Scan