SICK AG vulnerabilities
115 vulnerabilities
Known vulnerabilities in SICK AG products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 98 products.
Products
50 of 98- TDC X401Gl15 vulnerabilities
- Baggage Analytics13 vulnerabilities
- Logistic Diagnostic Analytics13 vulnerabilities
- Package Analytics13 vulnerabilities
- Tire Analytics13 vulnerabilities
- Enterprise Analytics10 vulnerabilities
- Apu02009 vulnerabilities
- Icr890 49 vulnerabilities
- SICK Field Analytics9 vulnerabilities
- SICK Media Server9 vulnerabilities
- SICK FTMG Esd15Axx AIR FLOW Sensor8 vulnerabilities
- SICK FTMG Esd20Axx AIR FLOW Sensor8 vulnerabilities
- SICK FTMG Esd25Axx AIR FLOW Sensor8 vulnerabilities
- SICK FTMG Esn40Sxx AIR FLOW Sensor8 vulnerabilities
- SICK FTMG Esn50Sxx AIR FLOW Sensor8 vulnerabilities
- SICK FTMG Esr40Sxx AIR FLOW Sensor8 vulnerabilities
- SICK FTMG Esr50Sxx AIR FLOW Sensor8 vulnerabilities
- SICK Inspectorp61X6 vulnerabilities
- SICK Inspectorp62X6 vulnerabilities
- Lms5Xx4 vulnerabilities
- Field Analytics3 vulnerabilities
- Incoming Goods Suite3 vulnerabilities
- SICK Dl100 2Xxxxxxx3 vulnerabilities
- Tloc100 100 All Firmware Versions3 vulnerabilities
- Eventcam App2 vulnerabilities
- SICK FLX3 Cpuc2002 vulnerabilities
- SICK Inspectorp8Xx2 vulnerabilities
- SICK Lector83X2 vulnerabilities
- SICK Lector85X2 vulnerabilities
- SICK Lector8Xx2 vulnerabilities
- SICK Lms10002 vulnerabilities
- SICK Mrs10002 vulnerabilities
- Tim3Xx2 vulnerabilities
- FX0 Gent000001 vulnerabilities
- FX0 Gent00000 Flexisoft EIP Gatew.1 vulnerabilities
- FX0 Gent00000 Flexisoft EIP Gatew.1 vulnerabilities
- FX0 Gent000101 vulnerabilities
- FX0 Gent00010 Flexisoft EIP GW (C)1 vulnerabilities
- FX0 Gent00010 Flexisoft EIP GW (C)1 vulnerabilities
- FX0 Gent000301 vulnerabilities
- FX0 Gent00030 Flexisoft EIP Gatew.V21 vulnerabilities
- FX0 Gent00030 Flexisoft EIP Gatew.V21 vulnerabilities
- FX0 Getc000001 vulnerabilities
- FX0 Getc00000 Flexisoft ETC GW1 vulnerabilities
- FX0 Getc00000 Flexisoft ETC GW1 vulnerabilities
- FX0 Getc000101 vulnerabilities
- FX0 Getc00010 Flexisoft ETC GW (C)1 vulnerabilities
- FX0 Getc00010 Flexisoft ETC GW (C)1 vulnerabilities
- FX0 Getc00040 Flexisoft ETC GW1 vulnerabilities
- FX0 Getc00040 Flexisoft ETC GW1 vulnerabilities
CVE-2026-101290sick agsick_safetyscanners_base cpp driver
EPSS score0.45%
A remote attacker may send a specially crafted network packet that causes the
affected application to perform an out-of-bounds memory read due to insufficient validation of
packet length. This may result in an application crash and a denial-of-service condition.CVE-2025-59462sick agtloc100-100 all firmware versionsEPSS score0.55%
An attacker who tampers with the C++ CLI client may crash the UpdateService during file transfers, disrupting updates and availability.CVE-2025-59460sick agtloc100-100 with firmware <7.1.1+1EPSS score0.43%
The system is deployed in its default state, with configuration settings that do not comply with the latest best practices for restricting access. This increases the risk of unauthorised connections.CVE-2025-59459sick agtloc100-100+1EPSS score0.34%
An attacker that gains SSH access to an unprivileged account may be able to disrupt services (including SSH), causing persistent loss of availability.CVE-2025-59463sick agtloc100-100 all firmware versionsEPSS score0.41%
An attacker may cause chunk-size mismatches that block file transfers and prevent subsequent transfers.CVE-2025-59461sick agtloc100-100 all firmware versionsEPSS score0.49%
A remote unauthenticated attacker may use the unauthenticated C++ API to access or modify sensitive data and disrupt services.CVE-2025-0593sick agsick inspectorp8xx+1EPSS score0.78%
The vulnerability may allow a remote low priviledged attacker to run arbitrary shell commands by using lower-level functions to interact with the device.CVE-2025-0867sick agsick meac300EPSS score0.63%
The standard user uses the run as function to start the MEAC applications with administrative privileges. To ensure that the system can startup on its own, the credentials of the administrator were stored. Consequently, the EPC2 user can execute any command with administrative privileges. This allows a privilege escalation to the administrative level.CVE-2025-0592sick agsick inspectorp8xx+1EPSS score0.36%
The vulnerability may allow a remote low priviledged attacker to run arbitrary shell commands by manipulating the firmware file and uploading it to the device.CVE-2025-9913sick agbaggage analytics+3EPSS score0.29%
JavaScript can be ran inside the address bar via the dashboard "Open in new Tab" Button, making the application vulnerable to session hijacking.CVE-2025-9914sick agbaggage analytics+3EPSS score0.32%
The credentials of the users stored in the system's local database can be used for the log in, making it possible for an attacker to gain unauthorized access. This could potentially affect the confidentiality of the application.CVE-2025-58589sick agbaggage analytics+3EPSS score0.36%
When an error occurs in the application a full stacktrace is provided to the user. The stacktrace lists class and method names as well as other internal information. An attacker thus receives information about the technology used and the structure of the application.CVE-2025-58585sick agbaggage analytics+3EPSS score0.43%
Multiple endpoints with sensitive information do not require authentication, making the application susceptible to information gathering.CVE-2025-58583sick agenterprise analyticsEPSS score0.36%
The application provides access to a login protected H2 database for caching purposes. The username is prefilled.CVE-2025-58591sick agbaggage analytics+3EPSS score0.53%
A remote, unauthorized attacker can brute force folders and files and read them like private keys or configurations, making the application vulnerable for gathering sensitive information.CVE-2025-58580sick agenterprise analyticsEPSS score0.36%
An API endpoint allows arbitrary log entries to be created via POST request. Without sufficient validation of the input data, an attacker can create manipulated log entries and thus falsify or dilute logs, for example.CVE-2025-58587sick agbaggage analytics+4EPSS score0.49%
The application does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame, making it possible for an attacker to guess user credentials.CVE-2025-58586sick agbaggage analytics+4EPSS score0.36%
For failed login attempts, the application returns different error messages depending on whether the login failed due to an incorrect password or a non-existing username. This allows an attacker to guess usernames until they find an existing one.CVE-2025-58584sick agbaggage analytics+4EPSS score0.39%
In the HTTP request, the username and password are transferred directly in the URL as parameters. However, URLs can be stored in various systems such as server logs, browser histories or proxy servers. As a result, there is a high risk that this sensitive data will be disclosed unintentionally.CVE-2025-58582sick agenterprise analyticsEPSS score0.55%
If a user tries to login but the provided credentials are incorrect a log is created. The data for this POST requests is not validated and it’s possible to send giant payloads which are then logged.