Read the docs
TI-2025-00496 Aliases CVE-2025-0592GHSA-qx7g-8cqg-c43v

SICK Lector8xx and InspectorP8xx vulnerable for code execution

Priority MEDIUM 40CWE-924Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

The vulnerability may allow a remote low priviledged attacker to run arbitrary shell commands by manipulating the firmware file and uploading it to the device.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00356 29th percentileScored 2026-11-07
Fix Fixed SICK Lector8xx (SICK AG): 2.4.0SICK InspectorP8xx (SICK AG): 3.11.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
SICK AGSICK Lector8xxbefore 2.4.02.4.0Patch availableCNA
SICK AGSICK InspectorP8xxbefore 3.11.13.11.1Patch availableCNA
  • SICK Lector8xx VendorSICK AG Affected before 2.4.0 Fixed in 2.4.0 Patch available CNA
  • SICK InspectorP8xx VendorSICK AG Affected before 3.11.1 Fixed in 3.11.1 Patch available CNA

Remediation

  • Fix · CNA SICK Lector8xx (SICK AG) Fixed in 2.4.0
  • Fix · CNA SICK InspectorP8xx (SICK AG) Fixed in 3.11.1

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Advisory ·

    SICK InspectorP8xx, SICK Lector8xx — sick.com/.well-known/csaf/white/2025/sca-2025-0002.json

    2 records Highest priority Priority MEDIUM 2 MEDIUM

    Other records, highest priority first

    • TI-2025-00497 SICK Lector8xx and InspectorP8xx vulnerable for code executionPriority MEDIUM 41
    Show all 2 records → Advisory →
  • Advisory ·

    SICK InspectorP8xx, SICK Lector8xx — sick.com/.well-known/csaf/white/2025/sca-2025-0002.pdf

    2 records Highest priority Priority MEDIUM 2 MEDIUM

    Other records, highest priority first

    • TI-2025-00497 SICK Lector8xx and InspectorP8xx vulnerable for code executionPriority MEDIUM 41
    Show all 2 records → Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-0592
  2. 2026-10-03 Alias added: GHSA-qx7g-8cqg-c43v

References

Advisory 2

Other 4

  • TI-2022-10578 Missing authentication in SICK SIM1004 CVSS 3.1CRITICAL 9.8
  • TI-2022-10577 Missing authentication in SICK SIM1000 FX CVSS 3.1CRITICAL 9.8
  • TI-2022-10576 Missing authentication in SICK SIM2000ST CVSS 3.1CRITICAL 9.8
  • TI-2022-10574 Missing authentication in SICK SIM4000 CVSS 3.1CRITICAL 9.8
  • TI-2026-01971 An attacker may perform unauthenticated read and write operations on sensitive filesystem… CVSS 3.1CRITICAL 9.8
  • TI-2023-09295 Missing authentication in FX0-GENT v3 Firmware CVSS 3.1CRITICAL 9.8
See all 145 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences