ICS-Advisories

Risk Evaluation

SICK identified multiple products affected by the Brotli vulnerability, also known as Broccoli2Shell (CVE-2026-111497). Successful exploitation of this vulnerability could impact the confidentiality, integrity, and availability of affected systems. At the time of publication, SICK is not aware of any active exploitation of this vulnerability targeting SICK products. SICK strongly recommends that customers review and implement the remediation measures provided in this advisory to reduce potential security risks.

Zusammenfassung der Gegenmaßnahmen

Users are recommended to re-install or upgrade to version 2026.1.3 while setting the global.imagePullPolicy to 'IfNotPresent'.

Risk Evaluation

SICK CorivaHub includes the third-party components Apache Tomcat and MapLibre GL, which are affected by two known vulnerabilities. These vulnerabilities include an improper input validation issue in Apache Tomcat and a vulnerability in MapLibre GL that could allow malicious behavior through custom GUIs. Under certain conditions, successful exploitation could affect the confidentiality, integrity and availability of the affected system. The attack surface associated with the Apache Tomcat vulnerability is significantly reduced by the default product configuration. Nevertheless, SICK recommends updating to CorivaHub 2026.1.2 to remediate both vulnerabilities.

Zusammenfassung der Gegenmaßnahmen

Users are recommended to upgrade to version 2026.1.2.

Risk Evaluation

An out-of-bounds read vulnerability exists in the open-source repository sick_safetyscanners_base (https://github.com/SICKAG/sick_safetyscanners_base), a standalone C++ driver library for SICK safety laser scanners. A specially crafted network packet could cause the library to read data beyond the bounds of the received buffer. If exploited, this vulnerability could potentially affect the availability of applications using the affected library. SICK recommends applying the defined remediations for this vulnerability.

Zusammenfassung der Gegenmaßnahmen

Users are recommended to upgrade to version 1.0.5.

Risk Evaluation

Multiple vulnerabilities in the third-party component fast-xml-parser affect the Device Manager Extension in Sentio Creator. The extension is maintained and updated independently from SICK Sentio Creator, but successful exploitation of these vulnerabilities could impact the security of the Sentio Creator. SICK strongly recommends upgrading the extension to remediate the identified issues.

Zusammenfassung der Gegenmaßnahmen

It is strongly recommended to upgrade the Device Manger Extension to version 1.1.1.

Risk Evaluation

Several vulnerabilities in the Wibu Systems CodeMeter Runtime affect the SICK products Sentio Creator, Sentio Compose, Safety Designer, Stream Editor, CODE-LOC, LiDAR-LOC, PLB, SIM1200-2A1A130 LiDAR-LOC and multiple SICK Industrial PCs (APU0G00, APU0G50, APU0G03, APU3F00, APU4600, APU8G00 and APU8G20), which ship with CodeMeter Runtime as part of their preinstalled image. For Sentio Compose, Safety Designer, Stream Editor and PLB, only CVE-2026-81572 is relevant. Vulnerabilities requiring the CodeMeter Runtime to be configured as a server are not applicable to default Sentio Compose, Safety Designer, Stream Editor and PLB installations, as the runtime is shipped with the Network Server and CmWAN Server functionalities disabled. Customers who have modified the default configuration and enabled CodeMeter server functionality should review the remaining vulnerabilities for potential impact. The vulnerabilities could potentially affect the integrity, confidentiality, and availability of the affected products.

Zusammenfassung der Gegenmaßnahmen

Customers are strongy recommended to update the Codemeter Runtime to the latest version (>= 9.10). The software can be downloaded directly on the Wibu Systems website: https://www.wibu.com/de/support/anwendersoftware/anwendersoftware.html

Risk Evaluation

SICK CorivaEngine includes the third-party components Netty and Spring Cloud Gateway that are affected by multiple known vulnerabilities. Under certain conditions, these vulnerabilities could allow remote attackers to perform HTTP request smuggling, cause resource exhaustion, or manipulate forwarded request headers. Successful exploitation may impact the integrity and availability of affected systems. SICK has addressed these vulnerabilities and recommends that customers apply the remediations described in this Security Advisory.

Zusammenfassung der Gegenmaßnahmen

Users are recommended to upgrade to version 2026.1.1.

Risk Evaluation

The Device Manager extension shipped with Sentio Creator is affected by CVE-2026-80469. Affected versions are pre-installed in Sentio Creator releases up to and including version 2026.2. As the Device Manager extension can be updated independently of Sentio Creator, SICK recommends applying the defined remediations for this vulnerability.

Zusammenfassung der Gegenmaßnahmen

Users are strongly recommended to upgrade the Device Manager extension for Sentio Creator to version 1.4.1.

Risk Evaluation

Multiple internal virtual filesystem paths are unintentionally accessible remotely in the SICK ICR890-4 and SICK InspectorP6xx devices. If exploited, this vulnerability could potentially allow an unauthenticated attacker to compromise the availability, integrity, and confidentiality of the devices.

Zusammenfassung der Gegenmaßnahmen

Users are recommended to upgrade to version 5.4.0.

Risk Evaluation

A vulnerability was discovered in several Endress+Hauser products that can be accessed via ethernet.

Zusammenfassung der Gegenmaßnahmen

Please make sure that only trusted entities have access to the device. Furthermore, you should apply the following General Security Measures when operating the product to mitigate the associated security risk. The ”ICS-CERT recommended practices on Industrial Security” could help to implement the general security practices.

Risk Evaluation

The pre-installed Software Deployment Manager extension in SICK Sentio Creator is affected by CVE-2026-33151. The Software Deployment Manager extension is maintained and updated independently from SICK Sentio Creator and therefore SICK recommends applying the defined remediations for the vulnerability.

Zusammenfassung der Gegenmaßnahmen

Users are strongly recommended to upgrade the Software Deployment Manager extension for Sentio Creator to version 0.14.0.

Risk Evaluation

SICK has found multiple vulnerabilities in SICK Enterprise Analytics and the SICK Logistic Analytics products. The vulnerabilities could potentially affect the confidentiality, integrity and availability of the products. Therefore it is strongly recommended to apply general security practices when operating the products. Currently, SICK is not aware of any public exploits.

Zusammenfassung der Gegenmaßnahmen

It is strongly recommended to update the product to version 4.6.3.

Risk Evaluation

The display unit of the Endress+Hauser MCS200HW is affected by a sudo chroot vulnerability.

Zusammenfassung der Gegenmaßnahmen

The display unit's firmware versions below 4.3.4 are affected. To address the vulnerability, customers are strongly recommended to update the display unit of their devices to firmware version 4.3.4. Endress+Hauser will include this firmware version in the MCS200HW products starting with version 1.11.5.6R. Alternatively, customers can contact Endress+Hauser directly to obtain the updated display firmware, or download the original firmware - including update instructions - from the Phoenix Contact website referenced below.

Risk Evaluation

FreeRTOS has several known vulnerabilities and is used in various SICK products. A current analysis confirms that the identified vulnerabilities in FreeRTOS do not affect the mentioned SICK products. At this time, there is no indication of any potential risks to these SICK products.

Zusammenfassung der Gegenmaßnahmen

Siehe das offizielle CISA-Advisory für Gegenmaßnahmen.

Risk Evaluation

Two vulnerabilities affecting the SICK Lector85x and SICK Lector83x product families have been identified. Both vulnerabilities are caused by insufficient access restrictions in HTTP-based interfaces, which may allow unauthenticated access to sensitive device resources. Depending on the configuration, this could lead to unauthorized modification of device settings and security-relevant data. SICK recommends applying the defined remediations for both vulnerabilities. SICK is currently not aware of any public exploits.

Zusammenfassung der Gegenmaßnahmen

Users are strongly recommended to upgrade to release version 2.8.0.

Risk Evaluation

Two vulnerabilities affect the SICK LMS1000 and SICK MRS1000 product families. The vulnerabilities allow the use of weak cryptographic configurations in the SSH service, which may enable an attacker with network access to observe, manipulate, or compromise the integrity of SSH communications. SICK recommends applying the defined remediations for both vulnerabilities.

Zusammenfassung der Gegenmaßnahmen

Users are strongly recommended to upgrade to release version 2.4.1.

Risk Evaluation

Eclipse Cyclone DDS has known vulnerabilities and is used in SICK picoScan150 and SICK picoScan120 products starting with version 2.2.0. A current analysis confirms that the identified vulnerabilities (CVE-2025-67109 and CVE-2023-24011) do not affect SICK picoScan150 and SICK picoScan120. Both vulnerabilities relate exclusively to certificate-based security features of ROS 2 / DDS, which are not supported on SICK picoScan150 and SICK picoScan120 devices and cannot be enabled by customers. At this time, there is no indication of any potential risk to SICK picoScan150 and SICK picoScan120 related to these two vulnerabilities.

Zusammenfassung der Gegenmaßnahmen

Siehe das offizielle CISA-Advisory für Gegenmaßnahmen.

Risk Evaluation

SICK has identified a 3rd party vulnerability (CVE-2025-55093) in the nanoScan3 and microScan3. Only specific variants within the microScan3 and nanoScan3 families are affected by CVE-2025-55093. The underlying issue in the NetX Duo networking module could, under specific conditions, cause the device to enter a safe error state that requires a restart. SICK recommends applying the mitigation for CVE-2025-55093.

Zusammenfassung der Gegenmaßnahmen

Ensure that an IP address is configured or assigned via DHCP and that the network is properly secured against unauthorized access so that only trusted entities have access to the devices. Furthermore, you should apply the following General Security Measures when operating the product to mitigate the associated security risk. The collected resources ”SICK Operating Guidelines” and ”ICS-CERT recommended practices on Industrial Security” could help to implement the general security practices.

Risk Evaluation

SICK has identified multiple vulnerabilities in the SICK Incoming Goods Suite product. Vulnerabilities related to Grafana apply exclusively to the administrative user interface for log management and do not affect the Incoming Goods Suite user interface. The vulnerabilities could potentially affect the confidentiality, integrity an availability of the product. Therefore it is strongly recommended to apply general security practices when operating the product.

Zusammenfassung der Gegenmaßnahmen

Users are strongly recommended to upgrade to the latest release of Incoming Goods Suite (>= 1.2.1).

Risk Evaluation

SICK has identified multiple vulnerabilities in the SICK TDC-X401GL product. The vulnerabilities could potentially affect the confidentiality, integrity an availability of the product. Therefore it is strongly recommended to apply general security practices when operating the product. SICK is currently not aware of any public exploits.

Zusammenfassung der Gegenmaßnahmen

Users are strongly recommended to upgrade to the latest release of TDC-X401GL (>= 1.4.0).

Risk Evaluation

SICK has identified multiple vulnerabilities in the SICK TLOC100-100 product. The vulnerabilities could potentially affect the confidentiality, integrity an availability of the product. Therefore it is strongly recommended to apply general security practices when operating the product. SICK is currently not aware of any public exploits.

Zusammenfassung der Gegenmaßnahmen

Please make sure that only trusted entities have access to the device. Furthermore, you should apply the following General Security Measures when operating the product to mitigate the associated security risk. The collected resources "SICK Operating Guidelines" and "ICS-CERT recommended practices on Industrial Security" could help to implement the general security practices.