# cve.now: Sick AG

The newest entries naming Sick AG as an affected vendor (up to 200), of 116 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-101290](https://cve.now/CVE-2026-101290.md): CVE-2026-101290 (CVSS 7.5)
- [CVE-2026-80469](https://cve.now/CVE-2026-80469.md): CVE-2026-80469 (CVSS 8.3)
- [CVE-2026-11841](https://cve.now/CVE-2026-11841.md): CVE-2026-11841 (CVSS 9.4)
- [CVE-2026-2331](https://cve.now/CVE-2026-2331.md): CVE-2026-2331 (CVSS 9.8)
- [CVE-2026-2330](https://cve.now/CVE-2026-2330.md): CVE-2026-2330 (CVSS 9.4)
- [CVE-2026-1627](https://cve.now/CVE-2026-1627.md): An attacker may exploit the use of outdated and weak MAC algorithms in the device’s SSH service to potentially compromise the integrity of t (CVSS 6.5)
- [CVE-2026-1626](https://cve.now/CVE-2026-1626.md): An attacker may exploit the use of weak CBC-based cipher suites in the device’s SSH service to potentially observe or manipulate parts of th (CVSS 6.5)
- [CVE-2026-22646](https://cve.now/CVE-2026-22646.md): Certain error messages returned by the application expose internal system details that should not be visible to end users, providing attacke (CVSS 4.3)
- [CVE-2026-22645](https://cve.now/CVE-2026-22645.md): The application discloses all used components, versions and license information to unauthenticated actors, giving attackers the opportunity (CVSS 5.3)
- [CVE-2026-22644](https://cve.now/CVE-2026-22644.md): Certain requests pass the authentication token in the URL as string query parameter, making it vulnerable to theft through server logs, prox (CVSS 5.3)
- [CVE-2026-22919](https://cve.now/CVE-2026-22919.md): An attacker with administrative access may inject malicious content into the login page, potentially enabling cross-site scripting (XSS) att (CVSS 3.8)
- [CVE-2026-22918](https://cve.now/CVE-2026-22918.md): An attacker may exploit missing protection against clickjacking by tricking users into performing unintended actions through maliciously cra (CVSS 4.3)
- [CVE-2026-22917](https://cve.now/CVE-2026-22917.md): Improper input handling in a system endpoint may allow attackers to overload resources, causing a denial of service. (CVSS 4.3)
- [CVE-2026-22916](https://cve.now/CVE-2026-22916.md): An attacker with low privileges may be able to trigger critical system functions such as reboot or factory reset without proper restrictions (CVSS 4.3)
- [CVE-2026-22915](https://cve.now/CVE-2026-22915.md): An attacker with low privileges may be able to read files from specific directories on the device, potentially exposing sensitive informatio (CVSS 4.3)
- [CVE-2026-22914](https://cve.now/CVE-2026-22914.md): An attacker with limited permissions may still be able to write files to specific locations on the device, potentially leading to system man (CVSS 4.3)
- [CVE-2026-22913](https://cve.now/CVE-2026-22913.md): Improper handling of a URL parameter may allow attackers to execute code in a user's browser after login. (CVSS 4.3)
- [CVE-2026-22912](https://cve.now/CVE-2026-22912.md): Improper validation of a login parameter may allow attackers to redirect users to malicious websites after authentication. (CVSS 4.3)
- [CVE-2026-22911](https://cve.now/CVE-2026-22911.md): Firmware update files may expose password hashes for system accounts, which could allow a remote attacker to recover credentials and gain un (CVSS 5.3)
- [CVE-2026-22910](https://cve.now/CVE-2026-22910.md): The device is deployed with weak and publicly known default passwords for certain hidden user levels, increasing the risk of unauthorized ac (CVSS 7.5)
- [CVE-2026-22909](https://cve.now/CVE-2026-22909.md): Certain system functions may be accessed without proper authorization, allowing attackers to start, stop, or delete installed applications, (CVSS 7.5)
- [CVE-2026-22908](https://cve.now/CVE-2026-22908.md): Uploading unvalidated container images may allow remote attackers to gain full access to the system, potentially compromising its integrity (CVSS 9.1)
- [CVE-2026-22907](https://cve.now/CVE-2026-22907.md): An attacker may gain unauthorized access to the host filesystem, potentially allowing them to read and modify system data. (CVSS 9.9)
- [CVE-2025-59463](https://cve.now/CVE-2025-59463.md): Denial-of-service (DoS) via chunk size mismatch (CVSS 4.3)
- [CVE-2025-59462](https://cve.now/CVE-2025-59462.md): Denial-of-service (DoS) via delayed or missing client response (CVSS 6.5)
- [CVE-2025-59461](https://cve.now/CVE-2025-59461.md): API does not require authentication (CVSS 7.6)
- [CVE-2025-59460](https://cve.now/CVE-2025-59460.md): Unsecure access configuration (CVSS 7.5)
- [CVE-2025-59459](https://cve.now/CVE-2025-59459.md): Denial-of-service (DoS) via resource consumption (CVSS 5.5)
- [CVE-2025-58579](https://cve.now/CVE-2025-58579.md): Username Disclosure Through Missing Authentication (CVSS 5.3)
- [CVE-2025-58591](https://cve.now/CVE-2025-58591.md): Path Traversal (CVSS 6.5)
- [CVE-2025-58590](https://cve.now/CVE-2025-58590.md): Path traversal (CVSS 6.5)
- [CVE-2025-58589](https://cve.now/CVE-2025-58589.md): Information Disclosure Through Stacktrace (CVSS 2.7)
- [CVE-2025-58587](https://cve.now/CVE-2025-58587.md): Improper Restriction of Excessive Authentication Attempts (CVSS 6.5)
- [CVE-2025-58586](https://cve.now/CVE-2025-58586.md): User Enumeration by excessive error output (CVSS 5.3)
- [CVE-2025-58585](https://cve.now/CVE-2025-58585.md): Sensitive Information Disclosure Through Missing Authentication (CVSS 5.3)
- [CVE-2025-58584](https://cve.now/CVE-2025-58584.md): Plain Text Transmission of Username and Password in the URL (CVSS 5.3)
- [CVE-2025-58583](https://cve.now/CVE-2025-58583.md): User Enumeration (CVSS 5.3)
- [CVE-2025-58582](https://cve.now/CVE-2025-58582.md): Uncontrolled Resource Consumption via log file (CVSS 5.3)
- [CVE-2025-58581](https://cve.now/CVE-2025-58581.md): Information Disclosure Through Stacktrace-/MQTT/Config/changeAll (CVSS 4.3)
- [CVE-2025-58580](https://cve.now/CVE-2025-58580.md): Injection via log file (CVSS 6.5)
- [CVE-2025-58578](https://cve.now/CVE-2025-58578.md): Unlimited user creation by authorized users (CVSS 3.8)
- [CVE-2025-9914](https://cve.now/CVE-2025-9914.md): The credentials of the users stored in the system's local database can be used for the log in, making it possible for an attacker to gain un (CVSS 4.3)
- [CVE-2025-9913](https://cve.now/CVE-2025-9913.md): Cross Site Scripting: Session Hijacking (CVSS 4.5)
- [CVE-2025-49200](https://cve.now/CVE-2025-49200.md): Unencrypted backup contains sensitive information (CVSS 6.5)
- [CVE-2025-49199](https://cve.now/CVE-2025-49199.md): Backup files can be modified and uploaded (CVSS 8.8)
- [CVE-2025-49198](https://cve.now/CVE-2025-49198.md): Poor quality of randomness in authorization tokens (CVSS 3.1)
- [CVE-2025-49197](https://cve.now/CVE-2025-49197.md): Deprecated TLS version supported (CVSS 6.5)
- [CVE-2025-49196](https://cve.now/CVE-2025-49196.md): Deprecated TLS version supported (CVSS 6.5)
- [CVE-2025-49195](https://cve.now/CVE-2025-49195.md): No protection against brute-force attacks (CVSS 5.3)
- [CVE-2025-49194](https://cve.now/CVE-2025-49194.md): Unencrypted communication (CVSS 7.5)
- [CVE-2025-49193](https://cve.now/CVE-2025-49193.md): Missing HTTP Security Headers (CVSS 4.2)
- [CVE-2025-49192](https://cve.now/CVE-2025-49192.md): Clickjacking (CVSS 4.3)
- [CVE-2025-49191](https://cve.now/CVE-2025-49191.md): Dashboards and iFrames can link malicious web content (CVSS 4.8)
- [CVE-2025-49190](https://cve.now/CVE-2025-49190.md): Server-Side Request Forgery (CVSS 4.3)
- [CVE-2025-49189](https://cve.now/CVE-2025-49189.md): Cookie missing HttpOnly flag (CVSS 5.3)
- [CVE-2025-49188](https://cve.now/CVE-2025-49188.md): Sensitive Data in URL (CVSS 5.3)
- [CVE-2025-49187](https://cve.now/CVE-2025-49187.md): User enumeration (CVSS 5.3)
- [CVE-2025-49186](https://cve.now/CVE-2025-49186.md): No brute-force protection (CVSS 5.3)
- [CVE-2025-49185](https://cve.now/CVE-2025-49185.md): Stored Cross-Site-Script (CVSS 5.5)
- [CVE-2025-49184](https://cve.now/CVE-2025-49184.md): Information disclosure to unauthorized user (CVSS 7.5)
- [CVE-2025-49183](https://cve.now/CVE-2025-49183.md): Unencrypted communication (HTTP) (CVSS 7.5)
- [CVE-2025-49182](https://cve.now/CVE-2025-49182.md): Credential disclosure (CVSS 7.5)
- [CVE-2025-49181](https://cve.now/CVE-2025-49181.md): Configurations endpoint does not require authorization (CVSS 8.6)
- [CVE-2025-32472](https://cve.now/CVE-2025-32472.md): DoS attack by conducting a slowloris-type attack (CVSS 5.3)
- [CVE-2025-32471](https://cve.now/CVE-2025-32471.md): Reuse of salt (CVSS 3.7)
- [CVE-2025-32470](https://cve.now/CVE-2025-32470.md): Unauthenticated change of IP adress (CVSS 7.5)
- [CVE-2025-27595](https://cve.now/CVE-2025-27595.md): Weak hashing alghrythm (CVSS 9.8)
- [CVE-2025-27594](https://cve.now/CVE-2025-27594.md): Unencrypted transmission of password hash (CVSS 7.5)
- [CVE-2025-27593](https://cve.now/CVE-2025-27593.md): RCE due to Device Driver (CVSS 9.3)
- [CVE-2025-0593](https://cve.now/CVE-2025-0593.md): SICK Lector8xx and InspectorP8xx vulnerable for code execution (CVSS 8.8)
- [CVE-2025-0592](https://cve.now/CVE-2025-0592.md): SICK Lector8xx and InspectorP8xx vulnerable for code execution (CVSS 8.8)
- [CVE-2025-0867](https://cve.now/CVE-2025-0867.md): Privilege Escalation in MEAC300 (CVSS 9.9)
- [CVE-2024-10776](https://cve.now/CVE-2024-10776.md): SICK InspectorP61x and SICK InspectorP62x: missing authentication (CVSS 8.2)
- [CVE-2024-10774](https://cve.now/CVE-2024-10774.md): SICK InspectorP61x and SICK InspectorP62x have unauthenticated CROWN APIs (CVSS 7.3)
- [CVE-2024-10773](https://cve.now/CVE-2024-10773.md): SICK InspectorP61x, SICK InspectorP62x and SICK TiM3xx are vulnerable for pass-the-hash attacks (CVSS 9.0)
- [CVE-2024-10772](https://cve.now/CVE-2024-10772.md): SICK InspectorP61x and SICK InspectorP62x are vulnerable for firmware modification (CVSS 8.8)
- [CVE-2024-10771](https://cve.now/CVE-2024-10771.md): SICK InspectorP61x, SICK InspectorP62x and SICK TiM3xx are vulnerable for remote code execution (CVSS 8.8)
- [CVE-2024-11022](https://cve.now/CVE-2024-11022.md): SICK InspectorP61x and SICK InspectorP62x are vulnerable for a replay attack (CVSS 5.6)
- [CVE-2024-11075](https://cve.now/CVE-2024-11075.md): SICK Incoming Goods Suite privilege escalation vulnerability (CVSS 8.8)
- [CVE-2024-10025](https://cve.now/CVE-2024-10025.md): Vulnerability in SICK CLV6xx, SICK Lector6xx and SICK RFx6xx (CVSS 9.1)
- [CVE-2024-8751](https://cve.now/CVE-2024-8751.md): CVE-2024-8751 (CVSS 7.5)
- [CVE-2023-5246](https://cve.now/CVE-2023-5246.md): Authentication Bypass by Capture-replay in SICK Flexi Soft Gateways with Partnumbers 1044073, 1127717, 1130282, 1044074, 1121597, 1099832, 1 (CVSS 8.8)
- [CVE-2023-5103](https://cve.now/CVE-2023-5103.md): Improper Restriction of Rendered UI Layers or Frames in RDT400 in SICK APU allows an unprivileged remote attacker to potentially reveal sens (CVSS 4.3)
- [CVE-2023-5102](https://cve.now/CVE-2023-5102.md): Insufficient Control Flow Management in RDT400 in SICK APU allows an unprivileged remote attacker to potentially enable hidden functionalit (CVSS 5.3)
- [CVE-2023-5101](https://cve.now/CVE-2023-5101.md): Files or Directories Accessible to External Parties in RDT400 in SICK APU allows an unprivileged remote attacker to download various files (CVSS 5.3)
- [CVE-2023-5100](https://cve.now/CVE-2023-5100.md): Cleartext Transmission of Sensitive Information in RDT400 in SICK APU allows an unprivileged remote attacker to retrieve potentially sensit (CVSS 5.9)
- [CVE-2023-43697](https://cve.now/CVE-2023-43697.md): Modification of Assumed-Immutable Data (MAID) in RDT400 in SICK APU allows an unprivileged remote attacker to make the site unable to load (CVSS 6.5)
- [CVE-2023-43698](https://cve.now/CVE-2023-43698.md): Improper Neutralization of Input During Web Page Generation (’Cross-site Scripting’) in RDT400 in SICK APU allows an unprivileged remote at (CVSS 7.1)
- [CVE-2023-43699](https://cve.now/CVE-2023-43699.md): Improper Restriction of Excessive Authentication Attempts in RDT400 in SICK APU allows an unprivileged remote attacker to guess the passwor (CVSS 7.5)
- [CVE-2023-43700](https://cve.now/CVE-2023-43700.md): Missing Authorization in RDT400 in SICK APU allows an unprivileged remote attacker to modify data via HTTP requests that no not require auth (CVSS 7.7)
- [CVE-2023-43696](https://cve.now/CVE-2023-43696.md): Improper Access Control in SICK APU allows an unprivileged remote attacker to download as well as upload arbitrary files via anonymous acce (CVSS 8.2)
- [CVE-2023-5288](https://cve.now/CVE-2023-5288.md): A remote unauthorized attacker may connect to the SIM1012, interact with the device and change configuration settings. (CVSS 9.8)
- [CVE-2023-31412](https://cve.now/CVE-2023-31412.md): The LMS5xx uses weak hash generation methods, resulting in the creation of insecure hashs. (CVSS 7.5)
- [CVE-2023-4420](https://cve.now/CVE-2023-4420.md): A remote unprivileged attacker can intercept the communication via e.g. (CVSS 9.8)
- [CVE-2023-4419](https://cve.now/CVE-2023-4419.md): The LMS5xx uses hard-coded credentials, which potentially allow low-skilled unauthorized remote attackers to reconfigure settings and /or di (CVSS 9.8)
- [CVE-2023-4418](https://cve.now/CVE-2023-4418.md): A remote unprivileged attacker can sent multiple packages to the LMS5xx to disrupt its availability through a TCP SYN-based denial-of-servic (CVSS 7.5)
- [CVE-2023-35699](https://cve.now/CVE-2023-35699.md): Cleartext Storage on Disk in the SICK ICR890-4 could allow an unauthenticated attacker with local access to the device to disclose sensitive (CVSS 5.3)
- [CVE-2023-35698](https://cve.now/CVE-2023-35698.md): Observable Response Discrepancy in the SICK ICR890-4 could allow a remote attacker to identify valid usernames for the FTP server from the r (CVSS 5.3)
- [CVE-2023-35697](https://cve.now/CVE-2023-35697.md): Improper Restriction of Excessive Authentication Attempts in the SICK ICR890-4 could allow a remote attacker to brute-force user credentials (CVSS 5.3)
- [CVE-2023-35696](https://cve.now/CVE-2023-35696.md): Unauthenticated endpoints in the SICK ICR890-4 could allow an unauthenticated remote attacker to retrieve sensitive information about the de (CVSS 7.5)
- [CVE-2023-3273](https://cve.now/CVE-2023-3273.md): Improper Access Control in the SICK ICR890-4 could allow an unauthenticated remote attacker to affect the availability of the device by chan (CVSS 7.5)
- [CVE-2023-3272](https://cve.now/CVE-2023-3272.md): Cleartext Transmission of Sensitive Information in the SICK ICR890-4 could allow a remote attacker to gather sensitive information by interc (CVSS 7.5)
- [CVE-2023-3271](https://cve.now/CVE-2023-3271.md): Improper Access Control in the SICK ICR890-4 could allow an unauthenticated remote attacker to gather information about the system and downl (CVSS 8.2)
- [CVE-2023-3270](https://cve.now/CVE-2023-3270.md): Exposure of Sensitive Information to an Unauthorized Actor in the SICK ICR890-4 could allow an unauthenticated remote attacker to retrieve s (CVSS 8.6)
- [CVE-2023-31411](https://cve.now/CVE-2023-31411.md): A remote unprivileged attacker can modify and access configuration settings on the EventCam App due to the absence of API authentication. (CVSS 9.8)
- [CVE-2023-31410](https://cve.now/CVE-2023-31410.md): A remote unprivileged attacker can intercept the communication via e.g. (CVSS 9.8)
- [CVE-2023-31409](https://cve.now/CVE-2023-31409.md): Uncontrolled Resource Consumption in SICK FTMg AIR FLOW SENSOR with Partnumbers 1100214, 1100215, 1100216, 1120114, 1120116, 1122524, 112252 (CVSS 5.3)
- [CVE-2023-31408](https://cve.now/CVE-2023-31408.md): Cleartext Storage of Sensitive Information in SICK FTMg AIR FLOW SENSOR with Partnumbers 1100214, 1100215, 1100216, 1120114, 1120116, 112252 (CVSS 5.3)
- [CVE-2023-23450](https://cve.now/CVE-2023-23450.md): Use of Password Hash Instead of Password for Authentication in SICK FTMg AIR FLOW SENSOR with Partnumbers 1100214, 1100215, 1100216, 1120114 (CVSS 6.2)
- [CVE-2023-23449](https://cve.now/CVE-2023-23449.md): Observable Response Discrepancy in SICK FTMg AIR FLOW SENSOR with Partnumbers 1100214, 1100215, 1100216, 1120114, 1120116, 1122524, 1122526 (CVSS 5.3)
- [CVE-2023-23448](https://cve.now/CVE-2023-23448.md): Inclusion of Sensitive Information in Source Code in SICK FTMg AIR FLOW SENSOR with Partnumbers 1100214, 1100215, 1100216, 1120114, 1120116, (CVSS 5.3)
- [CVE-2023-23447](https://cve.now/CVE-2023-23447.md): Uncontrolled Resource Consumption in SICK FTMg AIR FLOW SENSOR with Partnumbers 1100214, 1100215, 1100216, 1120114, 1120116, 1122524, 112252 (CVSS 7.5)
- [CVE-2023-23446](https://cve.now/CVE-2023-23446.md): Improper Access Control in SICK FTMg AIR FLOW SENSOR with Partnumbers 1100214, 1100215, 1100216, 1120114, 1120116, 1122524, 1122526 allows a (CVSS 7.5)
- [CVE-2023-23445](https://cve.now/CVE-2023-23445.md): Improper Access Control in SICK FTMg AIR FLOW SENSOR with Partnumbers 1100214, 1100215, 1100216, 1120114, 1120116, 1122524, 1122526 allows a (CVSS 7.5)
- [CVE-2023-23444](https://cve.now/CVE-2023-23444.md): Missing Authentication for Critical Function in SICK Flexi Classic and Flexi Soft Gateways with Partnumbers 1042193, 1042964, 1044078, 10440 (CVSS 7.5)
- [CVE-2019-10979](https://cve.now/CVE-2019-10979.md): SICK MSC800 all versions prior to Version 4.0, the affected firmware versions contain a hard-coded customer account password. (no CVSS)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/sick
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.