Log in Start free

Vulnerability · Published Mar 6, 2026 · Assigned by SICK AG

CVE-2026-2331CVE-2026-2331

Critical 9.8

In plain English

A critical-severity security flaw in SICK Lector83x from SICK AG. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.0% (higher than 62% of all known vulnerabilities).

Severity (CVSS 3.1)9.8Critical
Exploit odds (30 days)1.0%top 37.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

An attacker may perform unauthenticated read and write operations on sensitive filesystem areas via the AppEngine Fileaccess over HTTP due to improper access restrictions. A critical filesystem directory was unintentionally exposed through the HTTP-based file access feature, allowing access without authentication. This includes device parameter files, enabling an attacker to read and modify application settings, including customer-defined passwords. Additionally, exposure of the custom application directory may allow execution of arbitrary Lua code within the sandboxed AppEngine environment.

Affected products (as reported)

VendorProductVersions
SICK AG SICK Lector85x 2.6.0 – through 2.7.0
SICK AG SICK Lector83x 2.6.0 – through 2.7.0

Weakness: CWE-552 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References