CVE-2026-11841

Summary

An attacker may perform unauthenticated read and write operations on sensitive filesystem areas via the AppEngine Fileaccess over HTTP due to improper access restrictions. A critical filesystem directory was unintentionally exposed through the HTTP-based file access feature, allowing access without authentication. This includes device parameter files, enabling an attacker to read and modify application settings, including customer-defined passwords. Additionally, exposure of the custom application directory may allow execution of arbitrary Lua code within the sandboxed AppEngine environment.

Affected Software

VendorProductVersion RangeStatus
SICK AGInspectorP61x0 < 5.4.0affected
SICK AGInspectorP62x0 < 5.4.0affected
SICK AGInspectorP65xall versionsaffected
SICK AGInspectorP63xall versionsaffected
SICK AGInspectorP64xall versionsaffected

Weaknesses

  • CWE-552: CWE-552 Files or directories accessible to external parties

Workarounds

Please make sure that only trusted entities have access to the device. Furthermore, you should apply the following General Security Measures when operating the product to mitigate the associated security risk. The collected resources ”SICK Operating Guidelines” and ”ICS-CERT recommended practices on Industrial Security” could help to implement the general security practices.

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: yes
    • Technical Impact: total

References