CVE-2026-11841criticalCWE-552

CVE-2026-11841: fallo crítico en SICK AG ICR890-4

CVE-2026-11841

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear ICR890-4+ Monitorear SICK InspectorP61x

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

28Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 9.4epss 0.9%
An attacker may perform unauthenticated read and write operations on sensitive filesystem areas via the AppEngine Fileaccess over HTTP due to improper access restrictions. A critical filesystem directory was unintentionally exposed through the HTTP-based file access feature, allowing access without authentication. This includes device parameter files, enabling an attacker to read and modify application settings, including customer-defined passwords. Additionally, exposure of the custom application directory may allow execution of arbitrary Lua code within the sandboxed AppEngine environment.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L
Productos afectados
SICK AG · ICR890-4SICK AG · InspectorP61xSICK AG · InspectorP62xSICK AG · InspectorP63xSICK AG · InspectorP64xSICK AG · InspectorP65x
CVEs relacionadas — SICK AG ICR890-4

En el mismo producto, de las más peligrosas a las menos.

CVE-2023-3273HIGHCVE-2023-3273EPSS 1.1%CVE-2023-3270HIGHCVE-2023-3270EPSS 1.0%CVE-2023-35696HIGHCVE-2023-35696EPSS 0.9%CVE-2023-3271HIGHCVE-2023-3271EPSS 0.9%CVE-2023-35697MEDIUMCVE-2023-35697EPSS 0.9%CVE-2023-35698MEDIUMCVE-2023-35698EPSS 0.8%