TI-2026-10219 Aliases CVE-2026-11841 GHSA-5x3h-wq76-mxqx

An attacker may perform unauthenticated read and write operations on sensitive filesystem…

MEDIUM 50CWE-552Published 2026-07-28 · Updated 2026-08-24

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Information disclosure
Confidentiality · integrity · availability: High · High · Low
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-552.

Summary

An attacker may perform unauthenticated read and write operations on sensitive filesystem areas via the AppEngine Fileaccess over HTTP due to improper access restrictions. A critical filesystem directory was unintentionally exposed through the HTTP-based file access feature, allowing access without authentication. This includes device parameter files, enabling an attacker to read and modify application settings, including customer-defined passwords. Additionally, exposure of the custom application directory may allow execution of arbitrary Lua code within the sandboxed AppEngine environment.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00854 58th percentileScored 2026-11-07

Fix Fixed InspectorP61x (SICK AG): 5.4.0InspectorP62x (SICK AG): 5.4.0+1 more product

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: Yes
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
SICK AG	InspectorP61x	before 5.4.0	5.4.0	Patch available	CNA
SICK AG	InspectorP62x	before 5.4.0	5.4.0	Patch available	CNA
SICK AG	InspectorP65x	all versions and later	—	No fix listed	CNA
SICK AG	InspectorP63x	all versions and later	—	No fix listed	CNA
SICK AG	InspectorP64x	all versions and later	—	No fix listed	CNA
SICK AG	ICR890-4	before 2.15.0	2.15.0	Patch available	CNA

InspectorP61x VendorSICK AG Affected before 5.4.0 Fixed in 5.4.0 Patch available CNA
InspectorP62x VendorSICK AG Affected before 5.4.0 Fixed in 5.4.0 Patch available CNA
InspectorP65x VendorSICK AG Affected all versions and later Fixed in — No fix listed CNA
InspectorP63x VendorSICK AG Affected all versions and later Fixed in — No fix listed CNA
InspectorP64x VendorSICK AG Affected all versions and later Fixed in — No fix listed CNA
ICR890-4 VendorSICK AG Affected before 2.15.0 Fixed in 2.15.0 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPE	Versions	Role	Vendor
cpe:2.3:o:sick:icr890-4_firmware::::::::	—	—	SICK AG

cpe:2.3:o:sick:icr890-4_firmware:*:*:*:*:*:*:*:* Versions — — ·SICK AG

Remediation

Fix · CNA InspectorP61x (SICK AG) Fixed in 5.4.0
Fix · CNA InspectorP62x (SICK AG) Fixed in 5.4.0
Fix · CNA ICR890-4 (SICK AG) Fixed in 2.15.0

Timeline

2026-10-02 Threatist record created from CVE-2026-11841
2026-10-03 Alias added: GHSA-5x3h-wq76-mxqx

References

Advisory 1

https://www.sick.com/.well-known/csaf/white/2026/sca-2026-0010.pdf

Other 5

TI-2022-10578 Missing authentication in SICK SIM1004 CVSS 3.1CRITICAL 9.8
TI-2022-10577 Missing authentication in SICK SIM1000 FX CVSS 3.1CRITICAL 9.8
TI-2022-10576 Missing authentication in SICK SIM2000ST CVSS 3.1CRITICAL 9.8
TI-2022-10574 Missing authentication in SICK SIM4000 CVSS 3.1CRITICAL 9.8
TI-2026-01971 An attacker may perform unauthenticated read and write operations on sensitive filesystem… CVSS 3.1CRITICAL 9.8
TI-2023-09295 Missing authentication in FX0-GENT v3 Firmware CVSS 3.1CRITICAL 9.8

See all 145 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences