SICK vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Latest high and critical flaws

• CVE-2026-101290 A remote attacker may send a specially crafted network packet that causes the affected application to perform an out-of-bounds memory read due to insufficient vHigh 7.5 · Oct 15, 2026
• CVE-2026-80469 An attacker may achieve arbitrary code execution on a target system by uploading a malicious device driver package, bypassing driver verification mechanisms, anHigh 8.3 · Sep 11, 2026
• CVE-2026-11841 An attacker may perform unauthenticated read and write operations on sensitive filesystem areas via the AppEngine Fileaccess over HTTP due to improper access reCritical 9.4 · Jul 28, 2026
• CVE-2026-2331 An attacker may perform unauthenticated read and write operations on sensitive filesystem areas via the AppEngine Fileaccess over HTTP due to improper access reCritical 9.8 · Mar 6, 2026
• CVE-2026-2330 An attacker may access restricted filesystem areas on the device via the CROWN REST interface due to incomplete whitelist enforcement.Critical 9.4 · Mar 6, 2026
• CVE-2026-22910 The device is deployed with weak and publicly known default passwords for certain hidden user levels, increasing the risk of unauthorized access.High 7.5 · Jan 15, 2026
• CVE-2026-22909 Certain system functions may be accessed without proper authorization, allowing attackers to start, stop, or delete installed applications, potentially disruptiHigh 7.5 · Jan 15, 2026
• CVE-2026-22908 Uploading unvalidated container images may allow remote attackers to gain full access to the system, potentially compromising its integrity and confidentiality.Critical 9.1 · Jan 15, 2026
• CVE-2026-22907 An attacker may gain unauthorized access to the host filesystem, potentially allowing them to read and modify system data.Critical 9.9 · Jan 15, 2026
• CVE-2025-59461 A remote unauthenticated attacker may use the unauthenticated C++ API to access or modify sensitive data and disrupt services.High 7.6 · Oct 27, 2025
• CVE-2025-59460 The system is deployed in its default state, with configuration settings that do not comply with the latest best practices for restricting access.High 7.5 · Oct 27, 2025
• CVE-2025-49199 The backup ZIPs are not signed by the application, leading to the possibility that an attacker can download a backup ZIP, modify and re-upload it.High 8.8 · Jun 12, 2025
• CVE-2025-49194 The server supports authentication methods in which credentials are sent in plaintext over unencrypted channels.High 7.5 · Jun 12, 2025
• CVE-2025-49184 A remote unauthorized attacker may gather sensitive information of the application, due to missing authorization of configuration settings of the product.High 7.5 · Jun 12, 2025
• CVE-2025-49183 All communication with the REST API is unencrypted (HTTP), allowing an attacker to intercept traffic between an actor and the webserver.High 7.5 · Jun 12, 2025
• CVE-2025-49182 Files in the source code contain login credentials for the admin user and the property configuration password, allowing an attacker to get full access to the apHigh 7.5 · Jun 12, 2025
• CVE-2025-49181 Due to missing authorization of an API endpoint, unauthorized users can send HTTP GET requests to gather sensitive information.High 8.6 · Jun 12, 2025
• CVE-2025-32470 A remote unauthenticated attacker may be able to change the IP adress of the device, and therefore affecting the availability of the device.High 7.5 · Apr 28, 2025
• CVE-2025-27595 The device uses a weak hashing alghorithm to create the password hash.Critical 9.8 · Mar 14, 2025
• CVE-2025-27594 The device uses an unencrypted, proprietary protocol for communication.High 7.5 · Mar 14, 2025
• CVE-2025-27593 The product can be used to distribute malicious code using SDD Device Drivers due to missing download verification checks, leading to code execution on target sCritical 9.3 · Mar 14, 2025
• CVE-2025-0593 The vulnerability may allow a remote low priviledged attacker to run arbitrary shell commands by using lower-level functions to interact with the device.High 8.8 · Feb 14, 2025
• CVE-2025-0592 The vulnerability may allow a remote low priviledged attacker to run arbitrary shell commands by manipulating the firmware file and uploading it to the device.High 8.8 · Feb 14, 2025
• CVE-2025-0867 The standard user uses the run as function to start the MEAC applications with administrative privileges.Critical 9.9 · Feb 14, 2025
• CVE-2024-10776 Lua apps can be deployed, removed, started, reloaded or stopped without authorization via AppManager.High 8.2 · Dec 6, 2024