Sick Operating Guidelines Cybersecurity
by SICK AG
CVEs (8)
| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2026-22907 | Cri | 0.64 | 9.9 | 0.00 | Jan 15, 2026 | An attacker may gain unauthorized access to the host filesystem, potentially allowing them to read and modify system data. | ||
| CVE-2026-22909 | Hig | 0.49 | 7.5 | 0.01 | Jan 15, 2026 | Certain system functions may be accessed without proper authorization, allowing attackers to start, stop, or delete installed applications, potentially disrupting system operations. | ||
| CVE-2025-59459 | Med | 0.36 | 5.5 | 0.00 | Oct 27, 2025 | An attacker that gains SSH access to an unprivileged account may be able to disrupt services (including SSH), causing persistent loss of availability. | ||
| CVE-2026-22911 | Med | 0.34 | 5.3 | 0.01 | Jan 15, 2026 | Firmware update files may expose password hashes for system accounts, which could allow a remote attacker to recover credentials and gain unauthorized access to the device. | ||
| CVE-2026-22916 | Med | 0.28 | 4.3 | 0.00 | Jan 15, 2026 | An attacker with low privileges may be able to trigger critical system functions such as reboot or factory reset without proper restrictions, potentially leading to service disruption or loss of configuration. | ||
| CVE-2026-22914 | Med | 0.28 | 4.3 | 0.00 | Jan 15, 2026 | An attacker with limited permissions may still be able to write files to specific locations on the device, potentially leading to system manipulation. | ||
| CVE-2026-22912 | Med | 0.28 | 4.3 | 0.00 | Jan 15, 2026 | Improper validation of a login parameter may allow attackers to redirect users to malicious websites after authentication. This can lead to various risk including stealing credentials from unsuspecting users. | ||
| CVE-2025-58578 | Low | 0.25 | 3.8 | 0.00 | Oct 6, 2025 | A user with the appropriate authorization can create any number of user accounts via an API endpoint using a POST request. There are no quotas, checking mechanisms or restrictions to limit the creation. |
- risk 0.64cvss 9.9epss 0.00
An attacker may gain unauthorized access to the host filesystem, potentially allowing them to read and modify system data.
- risk 0.49cvss 7.5epss 0.01
Certain system functions may be accessed without proper authorization, allowing attackers to start, stop, or delete installed applications, potentially disrupting system operations.
- risk 0.36cvss 5.5epss 0.00
An attacker that gains SSH access to an unprivileged account may be able to disrupt services (including SSH), causing persistent loss of availability.
- risk 0.34cvss 5.3epss 0.01
Firmware update files may expose password hashes for system accounts, which could allow a remote attacker to recover credentials and gain unauthorized access to the device.
- risk 0.28cvss 4.3epss 0.00
An attacker with low privileges may be able to trigger critical system functions such as reboot or factory reset without proper restrictions, potentially leading to service disruption or loss of configuration.
- risk 0.28cvss 4.3epss 0.00
An attacker with limited permissions may still be able to write files to specific locations on the device, potentially leading to system manipulation.
- risk 0.28cvss 4.3epss 0.00
Improper validation of a login parameter may allow attackers to redirect users to malicious websites after authentication. This can lead to various risk including stealing credentials from unsuspecting users.
- risk 0.25cvss 3.8epss 0.00
A user with the appropriate authorization can create any number of user accounts via an API endpoint using a POST request. There are no quotas, checking mechanisms or restrictions to limit the creation.