CVE-2026-22645

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-22645", "assignerOrgId": "a6863dd2-93fc-443d-bef1-79f0b5020988", "state": "PUBLISHED", "assignerShortName": "SICK AG", "dateReserved": "2026-01-08T09:59:06.199Z", "datePublished": "2026-01-15T13:14:38.264Z", "dateUpdated": "2026-01-15T14:42:15.554Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "affected", "product": "Incoming Goods Suite", "vendor": "SICK AG", "versions": [{"lessThan": "1.2.1", "status": "affected", "version": "0", "versionType": "custom"}]}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>The application discloses all used components, versions and license information to unauthenticated actors, giving attackers the opportunity to target known security vulnerabilities of used components.</p>"}], "value": "The application discloses all used components, versions and license information to unauthenticated actors, giving attackers the opportunity to target known security vulnerabilities of used components."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "environmentalScore": 5.3, "environmentalSeverity": "MEDIUM", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "temporalScore": 5.3, "temporalSeverity": "MEDIUM", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-200", "description": "CWE-200 Exposure of Sensitive Information to an Unauthorized Actor", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "a6863dd2-93fc-443d-bef1-79f0b5020988", "shortName": "SICK AG", "dateUpdated": "2026-01-15T13:14:38.264Z"}, "references": [{"tags": ["x_SICK PSIRT Security Advisories"], "url": "https://sick.com/psirt"}, {"tags": ["x_SICK Operating Guidelines"], "url": "https://www.sick.com/media/docs/9/19/719/special_information_sick_operating_guidelines_cybersecurity_by_sick_en_im0106719.pdf"}, {"tags": ["x_ICS-CERT recommended practices on Industrial Security"], "url": "https://www.cisa.gov/resources-tools/resources/ics-recommended-practices"}, {"tags": ["x_CVSS v3.1 Calculator"], "url": "https://www.first.org/cvss/calculator/3.1"}, {"tags": ["x_The canonical URL."], "url": "https://www.sick.com/.well-known/csaf/white/2026/sca-2026-0002.json"}, {"tags": ["vendor-advisory"], "url": "https://www.sick.com/.well-known/csaf/white/2026/sca-2026-0002.pdf"}], "solutions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>Users are strongly recommended to upgrade to the latest release of Incoming Goods Suite (&gt;= 1.2.1).</p>"}], "value": "Users are strongly recommended to upgrade to the latest release of Incoming Goods Suite (>= 1.2.1)."}], "source": {"advisory": "SCA-2026-0002", "discovery": "INTERNAL"}, "x_generator": {"engine": "csaf2cve 0.2.1"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-01-15T14:40:57.468033Z", "id": "CVE-2026-22645", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-15T14:42:15.554Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-22645", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-01-15T14:40:57.468033Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-15T14:41:23.552Z"}}], "cna": {"source": {"advisory": "SCA-2026-0002", "discovery": "INTERNAL"}, "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "temporalScore": 5.3, "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "temporalSeverity": "MEDIUM", "availabilityImpact": "NONE", "environmentalScore": 5.3, "privilegesRequired": "NONE", "confidentialityImpact": "LOW", "environmentalSeverity": "MEDIUM"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "SICK AG", "product": "Incoming Goods Suite", "versions": [{"status": "affected", "version": "0", "lessThan": "1.2.1", "versionType": "custom"}], "defaultStatus": "affected"}], "solutions": [{"lang": "en", "value": "Users are strongly recommended to upgrade to the latest release of Incoming Goods Suite (>= 1.2.1).", "supportingMedia": [{"type": "text/html", "value": "<p>Users are strongly recommended to upgrade to the latest release of Incoming Goods Suite (&gt;= 1.2.1).</p>", "base64": false}]}], "references": [{"url": "https://sick.com/psirt", "tags": ["x_SICK PSIRT Security Advisories"]}, {"url": "https://www.sick.com/media/docs/9/19/719/special_information_sick_operating_guidelines_cybersecurity_by_sick_en_im0106719.pdf", "tags": ["x_SICK Operating Guidelines"]}, {"url": "https://www.cisa.gov/resources-tools/resources/ics-recommended-practices", "tags": ["x_ICS-CERT recommended practices on Industrial Security"]}, {"url": "https://www.first.org/cvss/calculator/3.1", "tags": ["x_CVSS v3.1 Calculator"]}, {"url": "https://www.sick.com/.well-known/csaf/white/2026/sca-2026-0002.json", "tags": ["x_The canonical URL."]}, {"url": "https://www.sick.com/.well-known/csaf/white/2026/sca-2026-0002.pdf", "tags": ["vendor-advisory"]}], "x_generator": {"engine": "csaf2cve 0.2.1"}, "descriptions": [{"lang": "en", "value": "The application discloses all used components, versions and license information to unauthenticated actors, giving attackers the opportunity to target known security vulnerabilities of used components.", "supportingMedia": [{"type": "text/html", "value": "<p>The application discloses all used components, versions and license information to unauthenticated actors, giving attackers the opportunity to target known security vulnerabilities of used components.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-200", "description": "CWE-200 Exposure of Sensitive Information to an Unauthorized Actor"}]}], "providerMetadata": {"orgId": "a6863dd2-93fc-443d-bef1-79f0b5020988", "shortName": "SICK AG", "dateUpdated": "2026-01-15T13:14:38.264Z"}}}, "cveMetadata": {"cveId": "CVE-2026-22645", "state": "PUBLISHED", "dateUpdated": "2026-01-15T14:42:15.554Z", "dateReserved": "2026-01-08T09:59:06.199Z", "assignerOrgId": "a6863dd2-93fc-443d-bef1-79f0b5020988", "datePublished": "2026-01-15T13:14:38.264Z", "assignerShortName": "SICK AG"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "affected", "product": "Incoming Goods Suite", "vendor": "SICK AG", "versions": [{"lessThan": "1.2.1", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "psirt@sick.de"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:sick:incoming_goods_suite:*:*:*:*:*:*:*:*", "matchCriteriaId": "E6E02E7A-B758-4262-9F62-24229C60F17A", "versionEndExcluding": "1.2.1", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The application discloses all used components, versions and license information to unauthenticated actors, giving attackers the opportunity to target known security vulnerabilities of used components."}, {"lang": "es", "value": "La aplicaci\u00f3n divulga todos los componentes utilizados, versiones e informaci\u00f3n de licencia a actores no autenticados, dando a los atacantes la oportunidad de atacar vulnerabilidades de seguridad conocidas de los componentes utilizados."}], "id": "CVE-2026-22645", "lastModified": "2026-06-17T10:20:11.860", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "psirt@sick.de", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-22645", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-01-15T14:40:57.468033Z", "version": "2.0.3"}}]}, "published": "2026-01-15T14:16:28.290", "references": [{"source": "psirt@sick.de", "tags": ["Vendor Advisory"], "url": "https://sick.com/psirt"}, {"source": "psirt@sick.de", "tags": ["US Government Resource"], "url": "https://www.cisa.gov/resources-tools/resources/ics-recommended-practices"}, {"source": "psirt@sick.de", "tags": ["Not Applicable"], "url": "https://www.first.org/cvss/calculator/3.1"}, {"source": "psirt@sick.de", "tags": ["Vendor Advisory"], "url": "https://www.sick.com/.well-known/csaf/white/2026/sca-2026-0002.json"}, {"source": "psirt@sick.de", "tags": ["Vendor Advisory"], "url": "https://www.sick.com/.well-known/csaf/white/2026/sca-2026-0002.pdf"}, {"source": "psirt@sick.de", "tags": ["Product"], "url": "https://www.sick.com/media/docs/9/19/719/special_information_sick_operating_guidelines_cybersecurity_by_sick_en_im0106719.pdf"}], "sourceIdentifier": "psirt@sick.de", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-200"}], "source": "psirt@sick.de", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-18T16:11:04.666032+00:00", "value": {"mitigation_remediation": ["Apply the vendor\u2019s latest release of Incoming Goods Suite (version\u00a01.2.1 or newer) to eliminate the disclosure flaw.", "Disable or restrict access to any debug, status, or configuration pages that expose component and version information.", "Configure the application and web server to return generic error responses and suppress stack traces for unauthenticated users."], "summary": {"action": "Upgrade", "impact": "Information Disclosure"}, "threat_synthesis": {"affected_systems": "SICK AG Incoming Goods Suite is affected. The specific product is the Incoming Goods Suite application distributed by SICK AG. No explicit version range is provided in the advisory, so all installations of the suite are potentially impacted.", "description_and_impact": "Based on the description, it is inferred that the vulnerability allows unauthenticated actors to retrieve detailed information about all components, their versions, and license data used by the application. This disclosure exposes security weaknesses of third\u2011party components, enabling attackers to identify and exploit known vulnerabilities. The weakness corresponds to CWE\u2011200, an Information Disclosure issue, and can compromise confidentiality by revealing sensitive configuration data.", "risk_and_exploitability": "The reported CVSS score of 5.3 indicates a moderate risk level, while the EPSS score of less than 1% shows a very low probability of exploitation at the time of analysis. The issue is not listed in the CISA KEV catalog, suggesting it is not a known exploit in the wild. Attackers could target this weakness by accessing public or internal web interfaces without authentication and collecting component metadata to plan further attacks."}}}}, "created": "2026-01-16T13:43:39.764903+00:00", "updated": "2026-04-18T16:15:04.607707+00:00", "vendors": ["sick_ag", "sick_ag$PRODUCT$incoming_goods_suite"]}