CVE-2026-2331criticalCWE-552

CVE-2026-2331: critical vulnerability in SICK Lector83x

CVE-2026-2331

Published · Updated

Follow this CVE+ Monitor SICK Lector83x+ Monitor SICK Lector85x

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

28Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 9.8epss 1.0%
An attacker may perform unauthenticated read and write operations on sensitive filesystem areas via the AppEngine Fileaccess over HTTP due to improper access restrictions. A critical filesystem directory was unintentionally exposed through the HTTP-based file access feature, allowing access without authentication. This includes device parameter files, enabling an attacker to read and modify application settings, including customer-defined passwords. Additionally, exposure of the custom application directory may allow execution of arbitrary Lua code within the sandboxed AppEngine environment.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
SICK AG · SICK Lector83xSICK AG · SICK Lector85x
Related CVEs — SICK Lector83x

In the same product, most dangerous first.

CVE-2026-2330CRITICALCVE-2026-2330EPSS 0.7%