Sick vulnerabilities
78 vulnerabilities
Known vulnerabilities in Sick products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 152 products.
Products
50 of 152- Apu02009 vulnerabilities
- Ftmg Esd15Axx8 vulnerabilities
- Ftmg Esd20Axx8 vulnerabilities
- Ftmg Esd25Axx8 vulnerabilities
- Ftmg Esn40Sxx8 vulnerabilities
- Ftmg Esn50Sxx8 vulnerabilities
- Ftmg Esr40Sxx8 vulnerabilities
- Ftmg Esr50Sxx8 vulnerabilities
- Icr890 48 vulnerabilities
- Media Server6 vulnerabilities
- Tdc X401Gl6 vulnerabilities
- Fx0 Gent000005 vulnerabilities
- Fx0 Gpnt000005 vulnerabilities
- Package Analytics4 vulnerabilities
- Fx0 Gent000103 vulnerabilities
- Fx0 Gmod000003 vulnerabilities
- Fx0 Gmod000103 vulnerabilities
- Fx0 Gpnt000103 vulnerabilities
- Msc8003 vulnerabilities
- Sopas Engineering Tool3 vulnerabilities
- Ftmg2 vulnerabilities
- Fx0 Gent000302 vulnerabilities
- Fx0 Gpnt000302 vulnerabilities
- Incoming Goods Suite2 vulnerabilities
- Lms10002 vulnerabilities
- Mrs10002 vulnerabilities
- Sim1000 Fx2 vulnerabilities
- Sim1012 0P0G2002 vulnerabilities
- Sim20002 vulnerabilities
- Sim2000St2 vulnerabilities
- Tloc100 1002 vulnerabilities
- Baggage Analytics1 vulnerabilities
- Field Analytics1 vulnerabilities
- Flexi Soft Designer1 vulnerabilities
- Flx3 Cpuc11 vulnerabilities
- Flx3 Cpuc21 vulnerabilities
- Fx0 Gepr000001 vulnerabilities
- Fx0 Gepr000101 vulnerabilities
- Fx0 Get000001 vulnerabilities
- Fx0 Get000101 vulnerabilities
- Fx0 Gmod000301 vulnerabilities
- Lms1001 vulnerabilities
- Lms1011 vulnerabilities
- Lms1111 vulnerabilities
- Lms1211 vulnerabilities
- Lms1221 vulnerabilities
- Lms1231 vulnerabilities
- Lms1311 vulnerabilities
- Lms1331 vulnerabilities
- Lms1411 vulnerabilities
CVE-2021-32498sicksopas_engineering_tool
EPSS score0.97%
SICK SOPAS ET before version 4.8.0 allows attackers to manipulate the pathname of the emulator and use path traversal to run an arbitrary executable located on the host system. When the user starts the emulator from SOPAS ET the corresponding executable will be started instead of the emulatorCVE-2021-32504sickftmg_firmwareEPSS score0.63%
Unauthenticated users can access sensitive web URLs through GET request, which should be restricted to maintenance users only. A malicious attacker could use this sensitive information’s to launch further attacks on the system.CVE-2021-32496sickvisionary-s_cx_firmwareEPSS score0.26%
SICK Visionary-S CX up version 5.21.2.29154R are vulnerable to an Inadequate Encryption Strength vulnerability concerning the internal SSH interface solely used by SICK for recovering returned devices. The use of weak ciphers make it easier for an attacker to break the security that protects information transmitted from the client to the SSH server, assuming the attacker has access to the network on which the device is connected. This can increase the risk that encryption will be compromised, leading to the exposure of sensitive user information and man-in-the-middle attacks.CVE-2021-32499sicksopas_engineering_toolEPSS score0.83%
SICK SOPAS ET before version 4.8.0 allows attackers to manipulate the command line arguments to pass in any value to the Emulator executable.CVE-2021-32497sicksopas_engineering_toolEPSS score0.76%
SICK SOPAS ET before version 4.8.0 allows attackers to wrap any executable file into an SDD and provide this to a SOPAS ET user. When a user starts the emulator the executable is run without further checks.CVE-2021-32503sickftmg_firmwareEPSS score0.83%
Unauthenticated users can access sensitive web URLs through GET request, which should be restricted to maintenance users only. A malicious attacker could use this sensitive information’s to launch further attacks on the system.CVE-2025-59460sick agtloc100-100 with firmware <7.1.1+1EPSS score0.43%
The system is deployed in its default state, with configuration settings that do not comply with the latest best practices for restricting access. This increases the risk of unauthorised connections.CVE-2025-59459sick agtloc100-100+1EPSS score0.34%
An attacker that gains SSH access to an unprivileged account may be able to disrupt services (including SSH), causing persistent loss of availability.CVE-2025-58590sick agbaggage analytics+7EPSS score0.53%
It's possible to brute force folders and files, what can be used by an attacker to steal sensitve information.CVE-2025-49181sick agsick media server+1EPSS score0.40%
Due to missing authorization of an API endpoint, unauthorized users can send HTTP GET
requests to gather sensitive information. An attacker could also send HTTP POST requests to modify
the log files’ root path as well as the TCP ports the service is running on, leading to a Denial of Service
attack.CVE-2025-49192sick agsick field analytics+3EPSS score0.33%
The web application is vulnerable to clickjacking attacks. The site can be embedded into another frame, allowing an attacker to trick a user into clicking on something different from what the user perceives. This could potentially reveal confidential information or allow others to take control of their computer while clicking on seemingly innocuous objects.CVE-2025-49182sick agsick media server+1EPSS score0.55%
Files in the source code contain login credentials for the admin user and the property configuration password, allowing an attacker to get full access to the application.CVE-2025-49189sick agsick media server+1EPSS score0.30%
The HttpOnlyflag of the session cookie \"@@\" is set to false. Since this flag helps preventing access to cookies via client-side scripts, setting the flag to false can lead to a higher possibility of Cross-Side-Scripting attacks which target the stored cookies.CVE-2025-49193sick agbaggage analytics+6EPSS score0.31%
The application fails to implement several security headers. These headers help increase the overall security level of the web application by e.g., preventing the application to be displayed in an iFrame (Clickjacking attacks) or not executing injected malicious JavaScript code (XSS attacks).CVE-2025-49197sick agsick media server+1EPSS score0.31%
The application uses a weak password hash function, allowing an attacker to crack the weak password hash to gain access to an FTP user account.CVE-2020-2078sickpackage_analyticsEPSS score0.75%
Passwords are stored in plain text within the configuration of SICK Package Analytics software up to and including V04.1.1. An authorized attacker could access these stored plaintext credentials and gain access to the ftp service. Storing a password in plaintext allows attackers to easily gain access to systems, potentially compromising personal information or other sensitive information.CVE-2020-2075sicklms100_firmware+14EPSS score1.44%
Platform mechanism AutoIP allows remote attackers to reboot the device via a crafted packet in SICK AG solutions Bulkscan LMS111, Bulkscan LMS511, CLV62x – CLV65x, ICR890-3, LMS10x, LMS11x, LMS15x, LMS12x, LMS13x, LMS14x, LMS5xx, LMS53x, MSC800, RFH.CVE-2020-2077sickpackage_analyticsEPSS score1.01%
SICK Package Analytics software up to and including version V04.0.0 are vulnerable due to incorrect default permissions settings. An unauthorized attacker could read sensitive data from the system by querying for known files using the REST API directly.CVE-2020-2076sickpackage_analyticsEPSS score1.26%
SICK Package Analytics software up to and including version V04.0.0 are vulnerable to an authentication bypass by directly interfacing with the REST API. An attacker can send unauthorized requests, bypass current authentication controls presented by the application and could potentially write files without authentication.CVE-2022-47377sicksim2000_firmwareEPSS score0.94%
Password recovery vulnerability in SICK SIM2000ST Partnumber 2086502 with firmware version <1.13.4 allows an unprivileged remote attacker to gain access to the userlevel defined as RecoverableUserLevel by invocating the password recovery mechanism method. This leads to an increase in their privileges on the system and thereby affecting the confidentiality integrity and availability of the system. An attacker can expect repeatable success by exploiting the vulnerability. The recommended solution is to update the firmware to a version >= 1.13.4 as soon as possible (available in SICK Support Portal).