Log in Start free

Vulnerability · Published Jul 28, 2026 · Assigned by SICK AG

CVE-2026-11841CVE-2026-11841

Critical 9.4

In plain English

A critical-severity security flaw in ICR890-4 from SICK AG. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.9% (higher than 58% of all known vulnerabilities).

Severity (CVSS 3.1)9.4Critical
Exploit odds (30 days)0.9%top 41.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

An attacker may perform unauthenticated read and write operations on sensitive filesystem areas via the AppEngine Fileaccess over HTTP due to improper access restrictions. A critical filesystem directory was unintentionally exposed through the HTTP-based file access feature, allowing access without authentication. This includes device parameter files, enabling an attacker to read and modify application settings, including customer-defined passwords. Additionally, exposure of the custom application directory may allow execution of arbitrary Lua code within the sandboxed AppEngine environment.

Affected products (as reported)

VendorProductVersions
SICK AG InspectorP61x 0 – before 5.4.0
SICK AG InspectorP62x 0 – before 5.4.0
SICK AG InspectorP65x all versions
SICK AG InspectorP63x all versions
SICK AG InspectorP64x all versions
SICK AG ICR890-4 0 – before 2.15.0

Weakness: CWE-552 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L

References