Sick AG vulnerabilities
116 CVEs and advisories name Sick AG as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-101290CVE-2026-101290
- CVE-2026-80469CVE-2026-80469
- CVE-2026-11841CVE-2026-11841
- CVE-2026-2331CVE-2026-2331
- CVE-2026-2330CVE-2026-2330
- CVE-2026-1627An attacker may exploit the use of outdated and weak MAC algorithms in the device’s SSH service to potentially compromise the integrity of t
- CVE-2026-1626An attacker may exploit the use of weak CBC-based cipher suites in the device’s SSH service to potentially observe or manipulate parts of th
- CVE-2026-22646Certain error messages returned by the application expose internal system details that should not be visible to end users, providing attacke
- CVE-2026-22645The application discloses all used components, versions and license information to unauthenticated actors, giving attackers the opportunity
- CVE-2026-22644Certain requests pass the authentication token in the URL as string query parameter, making it vulnerable to theft through server logs, prox
- CVE-2026-22919An attacker with administrative access may inject malicious content into the login page, potentially enabling cross-site scripting (XSS) att
- CVE-2026-22918An attacker may exploit missing protection against clickjacking by tricking users into performing unintended actions through maliciously cra
- CVE-2026-22917Improper input handling in a system endpoint may allow attackers to overload resources, causing a denial of service.
- CVE-2026-22916An attacker with low privileges may be able to trigger critical system functions such as reboot or factory reset without proper restrictions
- CVE-2026-22915An attacker with low privileges may be able to read files from specific directories on the device, potentially exposing sensitive informatio
- CVE-2026-22914An attacker with limited permissions may still be able to write files to specific locations on the device, potentially leading to system man
- CVE-2026-22913Improper handling of a URL parameter may allow attackers to execute code in a user's browser after login.
- CVE-2026-22912Improper validation of a login parameter may allow attackers to redirect users to malicious websites after authentication.
- CVE-2026-22911Firmware update files may expose password hashes for system accounts, which could allow a remote attacker to recover credentials and gain un
- CVE-2026-22910The device is deployed with weak and publicly known default passwords for certain hidden user levels, increasing the risk of unauthorized ac
- CVE-2026-22909Certain system functions may be accessed without proper authorization, allowing attackers to start, stop, or delete installed applications,
- CVE-2026-22908Uploading unvalidated container images may allow remote attackers to gain full access to the system, potentially compromising its integrity
- CVE-2026-22907An attacker may gain unauthorized access to the host filesystem, potentially allowing them to read and modify system data.
- CVE-2025-59463Denial-of-service (DoS) via chunk size mismatch
- CVE-2025-59462Denial-of-service (DoS) via delayed or missing client response
- CVE-2025-59461API does not require authentication
- CVE-2025-59460Unsecure access configuration
- CVE-2025-59459Denial-of-service (DoS) via resource consumption
- CVE-2025-58579Username Disclosure Through Missing Authentication
- CVE-2025-58591Path Traversal