CVE-2026-2331

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-2331", "assignerOrgId": "a6863dd2-93fc-443d-bef1-79f0b5020988", "state": "PUBLISHED", "assignerShortName": "SICK AG", "dateReserved": "2026-02-11T09:33:16.256Z", "datePublished": "2026-03-06T07:56:35.445Z", "dateUpdated": "2026-03-09T21:04:31.505Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "affected", "product": "SICK Lector85x", "vendor": "SICK AG", "versions": [{"lessThanOrEqual": "2.7.0", "status": "affected", "version": "2.6.0", "versionType": "custom"}]}, {"defaultStatus": "affected", "product": "SICK Lector83x", "vendor": "SICK AG", "versions": [{"lessThanOrEqual": "2.7.0", "status": "affected", "version": "2.6.0", "versionType": "custom"}]}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>An attacker may perform unauthenticated read and write operations on sensitive filesystem areas via the AppEngine Fileaccess over HTTP due to improper access restrictions. A critical filesystem directory was unintentionally exposed through the HTTP-based file access feature, allowing access without authentication. This includes device parameter files, enabling an attacker to read and modify application settings, including customer-defined passwords. Additionally, exposure of the custom application directory may allow execution of arbitrary Lua code within the sandboxed AppEngine environment.</p>"}], "value": "An attacker may perform unauthenticated read and write operations on sensitive filesystem areas via the AppEngine Fileaccess over HTTP due to improper access restrictions. A critical filesystem directory was unintentionally exposed through the HTTP-based file access feature, allowing access without authentication. This includes device parameter files, enabling an attacker to read and modify application settings, including customer-defined passwords. Additionally, exposure of the custom application directory may allow execution of arbitrary Lua code within the sandboxed AppEngine environment."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "environmentalScore": 9.8, "environmentalSeverity": "CRITICAL", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "temporalScore": 9.8, "temporalSeverity": "CRITICAL", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-552", "description": "CWE-552 Files or Directories Accessible to External Parties", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "a6863dd2-93fc-443d-bef1-79f0b5020988", "shortName": "SICK AG", "dateUpdated": "2026-03-06T07:56:35.445Z"}, "references": [{"tags": ["x_SICK PSIRT Security Advisories"], "url": "https://www.sick.com/psirt"}, {"tags": ["x_SICK Operating Guidelines"], "url": "https://www.sick.com/media/docs/9/19/719/special_information_sick_operating_guidelines_cybersecurity_by_sick_en_im0106719.pdf"}, {"tags": ["x_ICS-CERT recommended practices on Industrial Security"], "url": "https://www.cisa.gov/resources-tools/resources/ics-recommended-practices"}, {"tags": ["x_CVSS v3.1 Calculator"], "url": "https://www.first.org/cvss/calculator/3.1"}, {"tags": ["x_The canonical URL."], "url": "https://www.sick.com/.well-known/csaf/white/2026/sca-2026-0006.json"}, {"tags": ["vendor-advisory"], "url": "https://www.sick.com/.well-known/csaf/white/2026/sca-2026-0006.pdf"}], "solutions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>Users are strongly recommended to upgrade to release version 2.8.0.</p>"}], "value": "Users are strongly recommended to upgrade to release version 2.8.0."}], "source": {"advisory": "SCA-2026-0006", "discovery": "INTERNAL"}, "title": "CVE-2026-2331", "x_generator": {"engine": "csaf2cve 0.2.1"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-2331", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-03-09T20:55:24.319999Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-09T21:04:31.505Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-2331", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-03-09T20:55:24.319999Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-09T20:58:04.190Z"}}], "cna": {"title": "CVE-2026-2331", "source": {"advisory": "SCA-2026-0006", "discovery": "INTERNAL"}, "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "temporalScore": 9.8, "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "temporalSeverity": "CRITICAL", "availabilityImpact": "HIGH", "environmentalScore": 9.8, "privilegesRequired": "NONE", "confidentialityImpact": "HIGH", "environmentalSeverity": "CRITICAL"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "SICK AG", "product": "SICK Lector85x", "versions": [{"status": "affected", "version": "2.6.0", "versionType": "custom", "lessThanOrEqual": "2.7.0"}], "defaultStatus": "affected"}, {"vendor": "SICK AG", "product": "SICK Lector83x", "versions": [{"status": "affected", "version": "2.6.0", "versionType": "custom", "lessThanOrEqual": "2.7.0"}], "defaultStatus": "affected"}], "solutions": [{"lang": "en", "value": "Users are strongly recommended to upgrade to release version 2.8.0.", "supportingMedia": [{"type": "text/html", "value": "<p>Users are strongly recommended to upgrade to release version 2.8.0.</p>", "base64": false}]}], "references": [{"url": "https://www.sick.com/psirt", "tags": ["x_SICK PSIRT Security Advisories"]}, {"url": "https://www.sick.com/media/docs/9/19/719/special_information_sick_operating_guidelines_cybersecurity_by_sick_en_im0106719.pdf", "tags": ["x_SICK Operating Guidelines"]}, {"url": "https://www.cisa.gov/resources-tools/resources/ics-recommended-practices", "tags": ["x_ICS-CERT recommended practices on Industrial Security"]}, {"url": "https://www.first.org/cvss/calculator/3.1", "tags": ["x_CVSS v3.1 Calculator"]}, {"url": "https://www.sick.com/.well-known/csaf/white/2026/sca-2026-0006.json", "tags": ["x_The canonical URL."]}, {"url": "https://www.sick.com/.well-known/csaf/white/2026/sca-2026-0006.pdf", "tags": ["vendor-advisory"]}], "x_generator": {"engine": "csaf2cve 0.2.1"}, "descriptions": [{"lang": "en", "value": "An attacker may perform unauthenticated read and write operations on sensitive filesystem areas via the AppEngine Fileaccess over HTTP due to improper access restrictions. A critical filesystem directory was unintentionally exposed through the HTTP-based file access feature, allowing access without authentication. This includes device parameter files, enabling an attacker to read and modify application settings, including customer-defined passwords. Additionally, exposure of the custom application directory may allow execution of arbitrary Lua code within the sandboxed AppEngine environment.", "supportingMedia": [{"type": "text/html", "value": "<p>An attacker may perform unauthenticated read and write operations on sensitive filesystem areas via the AppEngine Fileaccess over HTTP due to improper access restrictions. A critical filesystem directory was unintentionally exposed through the HTTP-based file access feature, allowing access without authentication. This includes device parameter files, enabling an attacker to read and modify application settings, including customer-defined passwords. Additionally, exposure of the custom application directory may allow execution of arbitrary Lua code within the sandboxed AppEngine environment.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-552", "description": "CWE-552 Files or Directories Accessible to External Parties"}]}], "providerMetadata": {"orgId": "a6863dd2-93fc-443d-bef1-79f0b5020988", "shortName": "SICK AG", "dateUpdated": "2026-03-06T07:56:35.445Z"}}}, "cveMetadata": {"cveId": "CVE-2026-2331", "state": "PUBLISHED", "dateUpdated": "2026-03-09T21:04:31.505Z", "dateReserved": "2026-02-11T09:33:16.256Z", "assignerOrgId": "a6863dd2-93fc-443d-bef1-79f0b5020988", "datePublished": "2026-03-06T07:56:35.445Z", "assignerShortName": "SICK AG"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "affected", "product": "SICK Lector85x", "vendor": "SICK AG", "versions": [{"lessThanOrEqual": "2.7.0", "status": "affected", "version": "2.6.0", "versionType": "custom"}]}, {"defaultStatus": "affected", "product": "SICK Lector83x", "vendor": "SICK AG", "versions": [{"lessThanOrEqual": "2.7.0", "status": "affected", "version": "2.6.0", "versionType": "custom"}]}], "source": "psirt@sick.de"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "An attacker may perform unauthenticated read and write operations on sensitive filesystem areas via the AppEngine Fileaccess over HTTP due to improper access restrictions. A critical filesystem directory was unintentionally exposed through the HTTP-based file access feature, allowing access without authentication. This includes device parameter files, enabling an attacker to read and modify application settings, including customer-defined passwords. Additionally, exposure of the custom application directory may allow execution of arbitrary Lua code within the sandboxed AppEngine environment."}, {"lang": "es", "value": "Un atacante puede realizar operaciones de lectura y escritura no autenticadas en \u00e1reas sensibles del sistema de archivos a trav\u00e9s del acceso a archivos de AppEngine sobre HTTP debido a restricciones de acceso inadecuadas. Un directorio cr\u00edtico del sistema de archivos fue expuesto involuntariamente a trav\u00e9s de la funci\u00f3n de acceso a archivos basada en HTTP, permitiendo el acceso sin autenticaci\u00f3n. Esto incluye archivos de par\u00e1metros del dispositivo, permitiendo a un atacante leer y modificar la configuraci\u00f3n de la aplicaci\u00f3n, incluyendo contrase\u00f1as definidas por el cliente. Adem\u00e1s, la exposici\u00f3n del directorio de la aplicaci\u00f3n personalizada puede permitir la ejecuci\u00f3n de c\u00f3digo Lua arbitrario dentro del entorno aislado de AppEngine."}], "id": "CVE-2026-2331", "lastModified": "2026-06-17T10:30:48.040", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "psirt@sick.de", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-2331", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-03-09T20:55:24.319999Z", "version": "2.0.3"}}]}, "published": "2026-03-06T08:16:27.450", "references": [{"source": "psirt@sick.de", "url": "https://www.cisa.gov/resources-tools/resources/ics-recommended-practices"}, {"source": "psirt@sick.de", "url": "https://www.first.org/cvss/calculator/3.1"}, {"source": "psirt@sick.de", "url": "https://www.sick.com/.well-known/csaf/white/2026/sca-2026-0006.json"}, {"source": "psirt@sick.de", "url": "https://www.sick.com/.well-known/csaf/white/2026/sca-2026-0006.pdf"}, {"source": "psirt@sick.de", "url": "https://www.sick.com/media/docs/9/19/719/special_information_sick_operating_guidelines_cybersecurity_by_sick_en_im0106719.pdf"}, {"source": "psirt@sick.de", "url": "https://www.sick.com/psirt"}], "sourceIdentifier": "psirt@sick.de", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-552"}], "source": "psirt@sick.de", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[2.6.0,2.7.0]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "SICK Lector83x", "source": "cna", "vendor": "SICK AG"}, "product": "sick_lector83x", "vendor": "sick_ag"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[2.6.0,2.7.0]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "SICK Lector85x", "source": "cna", "vendor": "SICK AG"}, "product": "sick_lector85x", "vendor": "sick_ag"}], "analysis": {"en": {"generated_at": "2026-04-17T12:22:10.732707+00:00", "value": {"mitigation_remediation": ["Upgrade to release version 2.8.0 as advised by the vendor.", "Restrict external network access to the device by firewalling or network segmentation so that only trusted internal networks can reach the HTTP interface.", "Persistently monitor for unauthorized file access attempts and anomalous Lua code execution on the device."], "summary": {"action": "Immediate Patch", "impact": "Remote code execution via unrestricted filesystem access"}, "threat_synthesis": {"affected_systems": "The vulnerability affects SICK AG\u2019s Lector\u00a083x and Lector\u00a085x product lines. No specific pre\u2011release version numbers are listed, but the vendor recommends any affected instance to upgrade to release\u00a02.8.0, implying the flaw is present in prior releases of these families.", "description_and_impact": "An attacker can exploit a missing access control in the AppEngine Fileaccess feature exposed over HTTP, allowing unauthenticated read and write operations against sensitive filesystem directories. The flaw exposes device configuration files, including customer\u2011defined passwords, and enables the injection of arbitrary Lua code into the sandboxed AppEngine environment, effectively granting remote code execution capabilities. The underlying weakness is identified as a sensitive file inclusion and disclosure flaw, consistent with CWE\u2011552.", "risk_and_exploitability": "With a CVSS score of 9.8, the vulnerability is categorised as critical. Epistemic probability of exploitation is reported as below 1% by EPSS, and it is not listed in the CISA Known Exploited Vulnerabilities catalog, indicating low current exploitation likelihood. Nonetheless, the flaw remains remotely exploitable over the device\u2019s HTTP interface without authentication, meaning that any network segment with traffic to the device is potentially at risk. The combination of high impact and low probability suggests that decisive mitigation actions are warranted to prevent any future exploitation."}}}}, "created": "2026-03-09T10:08:10.972291+00:00", "title": "Unauthenticated HTTP File Access Exposes Sensitive Configs and Enables Lua Code Execution", "updated": "2026-04-17T12:30:06.230415+00:00", "vendors": ["sick_ag", "sick_ag$PRODUCT$sick_lector83x", "sick_ag$PRODUCT$sick_lector85x"]}