Read the docs
TI-2026-74666 Aliases CVE-2026-101290

Out-of-bounds read in SICK AG Sick_Safetyscanners_Base CPP Driver

Priority LOW 39CWE-125Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-125 and the CVSS impact.

Summary

SICK AG Sick_Safetyscanners_Base CPP Driver from 0 through 1.0.4 is affected. Insufficient validation of packet length causes an out of bounds memory read (CWE-125). A remote attacker can send a specially crafted network packet to crash the affected application, causing a denial of service. CISA does not list it in KEV and rates exploitation as none.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

A remote attacker may send a specially crafted network packet that causes the affected application to perform an out-of-bounds memory read due to insufficient validation of packet length. This may result in an application crash and a denial-of-service condition.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00453 39th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
SICK AGSick_Safetyscanners_Base CPP Driverup to 1.0.4—No fix listedCNA
  • Sick_Safetyscanners_Base CPP Driver VendorSICK AG Affected up to 1.0.4 Fixed in — No fix listed CNA

Remediation

No fixed version is listed for Sick_Safetyscanners_Base CPP Driver.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Timeline

  1. 2026-10-16 Threatist record created from CVE-2026-101290

References

Advisory 1

Other 5

  • TI-2022-10578 Missing authentication in SICK SIM1004 CVSS 3.1CRITICAL 9.8
  • TI-2022-10577 Missing authentication in SICK SIM1000 FX CVSS 3.1CRITICAL 9.8
  • TI-2022-10576 Missing authentication in SICK SIM2000ST CVSS 3.1CRITICAL 9.8
  • TI-2022-10574 Missing authentication in SICK SIM4000 CVSS 3.1CRITICAL 9.8
  • TI-2026-01971 An attacker may perform unauthenticated read and write operations on sensitive filesystem… CVSS 3.1CRITICAL 9.8
  • TI-2023-09295 Missing authentication in FX0-GENT v3 Firmware CVSS 3.1CRITICAL 9.8
See all 145 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences