SICK AG vulnerabilities, page 3
115 vulnerabilities
Known vulnerabilities in SICK AG products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 98 products.
CVE-2025-49182sick agsick media server+1
EPSS score0.55%
Files in the source code contain login credentials for the admin user and the property configuration password, allowing an attacker to get full access to the application.CVE-2025-49183sick agsick media serverEPSS score0.31%
All communication with the REST API is unencrypted (HTTP), allowing an attacker to intercept traffic between an actor and the webserver. This leads to the possibility of information gathering and downloading media files.CVE-2025-49189sick agsick media server+1EPSS score0.30%
The HttpOnlyflag of the session cookie \"@@\" is set to false. Since this flag helps preventing access to cookies via client-side scripts, setting the flag to false can lead to a higher possibility of Cross-Side-Scripting attacks which target the stored cookies.CVE-2025-49193sick agbaggage analytics+6EPSS score0.31%
The application fails to implement several security headers. These headers help increase the overall security level of the web application by e.g., preventing the application to be displayed in an iFrame (Clickjacking attacks) or not executing injected malicious JavaScript code (XSS attacks).CVE-2025-49195sick agsick media serverEPSS score0.52%
The FTP server’s login mechanism does not restrict authentication attempts, allowing an attacker to brute-force user passwords and potentially compromising the FTP server.CVE-2025-49199sick agsick field analyticsEPSS score0.33%
The backup ZIPs are not signed by the application, leading to the possibility that an attacker can download a backup ZIP, modify and re-upload it. This allows the attacker to disrupt the application by configuring the services in a way that they are unable to run, making the application unusable. They can redirect traffic that is meant to be internal to their own hosted services and gathering information.CVE-2025-49197sick agsick media server+1EPSS score0.31%
The application uses a weak password hash function, allowing an attacker to crack the weak password hash to gain access to an FTP user account.CVE-2025-32471sick agsick flx3-cpuc200+1EPSS score0.38%
The device’s passwords have not been adequately salted, making them vulnerable to password extraction attacks.CVE-2025-32472sick agsick multiscan1xx+1EPSS score0.62%
The multiScan and picoScan are vulnerable to a denial-of-service (DoS) attack. A remote attacker can exploit this vulnerability by conducting a Slowloris-type attack, causing the web page to become unresponsive.CVE-2025-32470sick agsick flx0-gpnt100+1EPSS score0.64%
A remote unauthenticated attacker may be able to change the IP adress of the device, and therefore affecting the availability of the device.CVE-2024-11075sick agsick incoming goods suiteEPSS score0.21%
A vulnerability in the Incoming Goods Suite allows a user with unprivileged access to the underlying system (e.g. local or via SSH) a privilege escalation to the administrative level due to the usage of component vendor Docker images running with root permissions. Exploiting this misconfiguration leads to the fact that an attacker can gain administrative control. over the whole system.CVE-2024-11022sick agsick inspectorp61x+1EPSS score0.41%
The authentication process to the web server uses a challenge response procedure which
inludes the nonce and additional information. This challenge can be used several times for login and is
therefore vulnerable for a replay attack.CVE-2024-10772sick agsick inspectorp61x+1EPSS score0.34%
Since the firmware update is not validated, an attacker can install modified firmware on the
device. This has a high impact on the availabilty, integrity and confidentiality up to the complete compromise of the device.CVE-2024-10776sick agsick inspectorp61x+1EPSS score0.50%
Lua apps can be deployed, removed, started, reloaded or stopped without authorization via
AppManager. This allows an attacker to remove legitimate apps creating a DoS attack, read and write
files or load apps that use all features of the product available to a customer.CVE-2024-10025sick agsick clv6xx+2EPSS score0.75%
A vulnerability in the .sdd file allows an attacker to read default passwords stored in plain text within the code. By exploiting these plaintext credentials, an attacker can log into affected SICK products as an “Authorized Client” if the customer has not changed the default password.CVE-2024-10773sick agsick inspectorp61x+2EPSS score0.59%
The product is vulnerable to pass-the-hash attacks in combination with hardcoded credentials of hidden user levels. This means that an attacker can log in with the hidden user levels and gain
full access to the device.CVE-2024-10774sick agsick inspectorp61x+1EPSS score0.46%
Unauthenticated CROWN APIs allow access to critical functions. This leads to the accessibility of large parts of the web application without authentication.CVE-2024-10771sick agsick inspectorp61x+3EPSS score1.10%
Due to missing input validation during one step of the firmware update process, the product
is vulnerable to remote code execution. With network access and the user level ”Service”, an attacker
can execute arbitrary system commands in the root user’s contexts.CVE-2024-8751endress+hauserflps+16EPSS score0.93%
A vulnerability allows a remote unauthenticated attacker to modify the prod
uct’s IP address over the Sopas ET interface. This can lead to a Denial of Service attack.CVE-2026-2331sick agsick lector83x+1EPSS score0.90%
An attacker may perform unauthenticated read and write operations on sensitive filesystem areas via the AppEngine Fileaccess over HTTP due to improper access restrictions. A critical filesystem directory was unintentionally exposed through the HTTP-based file access feature, allowing access without authentication. This includes device parameter files, enabling an attacker to read and modify application settings, including customer-defined passwords. Additionally, exposure of the custom application directory may allow execution of arbitrary Lua code within the sandboxed AppEngine environment.