CVE-2026-11841criticalCWE-552

CVE-2026-11841: critical vulnerability in SICK AG ICR890-4

CVE-2026-11841

Published · Updated

Follow this CVE+ Monitor ICR890-4+ Monitor SICK InspectorP61x

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

28Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 9.4epss 0.9%
An attacker may perform unauthenticated read and write operations on sensitive filesystem areas via the AppEngine Fileaccess over HTTP due to improper access restrictions. A critical filesystem directory was unintentionally exposed through the HTTP-based file access feature, allowing access without authentication. This includes device parameter files, enabling an attacker to read and modify application settings, including customer-defined passwords. Additionally, exposure of the custom application directory may allow execution of arbitrary Lua code within the sandboxed AppEngine environment.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L
Affected products
SICK AG · ICR890-4SICK AG · InspectorP61xSICK AG · InspectorP62xSICK AG · InspectorP63xSICK AG · InspectorP64xSICK AG · InspectorP65x
Related CVEs — SICK AG ICR890-4

In the same product, most dangerous first.

CVE-2023-3273HIGHCVE-2023-3273EPSS 1.1%CVE-2023-3270HIGHCVE-2023-3270EPSS 1.0%CVE-2023-35696HIGHCVE-2023-35696EPSS 0.9%CVE-2023-3271HIGHCVE-2023-3271EPSS 0.9%CVE-2023-35697MEDIUMCVE-2023-35697EPSS 0.9%CVE-2023-35698MEDIUMCVE-2023-35698EPSS 0.8%