Vulnerabilidades em SICK AG

115 resultados
Análise Vexday

O portfólio de vulnerabilidades da SICK AG reúne 112 CVEs catalogadas, com 14 classificadas como severidade crítica, mas nenhuma atualmente registrada no catálogo CISA KEV de exploração ativa — taxa abaixo da média geral do catálogo, o que sugere pressão ofensiva relativamente contida sobre os produtos da empresa. A ausência de PoCs públicas e de novas CVEs nos últimos 90 dias reforça um cenário de superfície de ataque estável no curto prazo. A falha mais comum é CWE-284 (controle de acesso impróprio), categoria que tende a ser crítica em ambientes de tecnologia operacional e dispositivos industriais, domínio típico da SICK AG. A CVE mais perigosa ativa, CVE-2023-23444, apresenta EPSS de 0,0117, indicando probabilidade de exploração baixa no momento, mas seu monitoramento contínuo é recomendado dado o contexto de infraestrutura industrial em que esses ativos costumam operar.

CVE-2026-22909HIGHCertain system functions may be accessed without proper authorization, allowing attackers to start, stop, or delete installed applications, EPSS 0.6%CVE-2026-22917MEDIUMImproper input handling in a system endpoint may allow attackers to overload resources, causing a denial of service.EPSS 0.6%CVE-2025-49182HIGHCredential disclosureEPSS 0.6%CVE-2025-58582MEDIUMUncontrolled Resource Consumption via log fileEPSS 0.6%CVE-2025-59462MEDIUMDenial-of-service (DoS) via delayed or missing client responseEPSS 0.5%CVE-2025-58590MEDIUMPath traversalEPSS 0.5%CVE-2025-58591MEDIUMPath TraversalEPSS 0.5%CVE-2025-27595CRITICALWeak hashing alghrythmEPSS 0.5%CVE-2026-22644MEDIUMCertain requests pass the authentication token in the URL as string query parameter, making it vulnerable to theft through server logs, proxEPSS 0.5%CVE-2026-22911MEDIUMFirmware update files may expose password hashes for system accounts, which could allow a remote attacker to recover credentials and gain unEPSS 0.5%CVE-2025-49195MEDIUMNo protection against brute-force attacksEPSS 0.5%CVE-2024-10776HIGHSICK InspectorP61x and SICK InspectorP62x: missing authenticationEPSS 0.5%CVE-2025-59461HIGHAPI does not require authenticationEPSS 0.5%CVE-2025-49184HIGHInformation disclosure to unauthorized userEPSS 0.5%CVE-2025-58587MEDIUMImproper Restriction of Excessive Authentication AttemptsEPSS 0.5%CVE-2026-22910HIGHThe device is deployed with weak and publicly known default passwords for certain hidden user levels, increasing the risk of unauthorized acEPSS 0.5%CVE-2025-49200MEDIUMUnencrypted backup contains sensitive informationEPSS 0.5%CVE-2024-10774HIGHSICK InspectorP61x and SICK InspectorP62x have unauthenticated CROWN APIsEPSS 0.5%CVE-2026-101290HIGHCVE-2026-101290EPSS 0.5%CVE-2025-27594HIGHUnencrypted transmission of password hashEPSS 0.5%