https://vulnogram.org/ Most recent CVEs assigned by SICK AG (sick_ag). https://vulnogram.org/seaview/icons/sick_ag.png https://vulnogram.org/ Wed, 21 Oct 2026 07:00:06 GMT https://vulnogram.org/CVE-2026-101290 https://vulnogram.org/CVE-2026-101290 A remote attacker may send a specially crafted network packet that causes the affected application to perform an out-of-bounds memory read due to insufficient validation of packet length. This may result in an application crash and a denial-of-servic… High Network Exploitable Thu, 15 Oct 2026 08:53:33 GMT https://vulnogram.org/CVE-2026-80469 https://vulnogram.org/CVE-2026-80469 An attacker may achieve arbitrary code execution on a target system by uploading a malicious device driver package, bypassing driver verification mechanisms, and triggering the execution of attacker-controlled code. User interaction is required. High Network Exploitable Fri, 11 Sep 2026 08:27:39 GMT https://vulnogram.org/CVE-2026-11841 https://vulnogram.org/CVE-2026-11841 An attacker may perform unauthenticated read and write operations on sensitive filesystem areas via the AppEngine Fileaccess over HTTP due to improper access restrictions. A critical filesystem directory was unintentionally exposed through the HTTP-b… Critical Network Exploitable Tue, 28 Jul 2026 09:25:36 GMT https://vulnogram.org/CVE-2026-2331 https://vulnogram.org/CVE-2026-2331 An attacker may perform unauthenticated read and write operations on sensitive filesystem areas via the AppEngine Fileaccess over HTTP due to improper access restrictions. A critical filesystem directory was unintentionally exposed through the HTTP-b… Critical Network Exploitable Fri, 06 Mar 2026 07:56:35 GMT https://vulnogram.org/CVE-2026-2330 https://vulnogram.org/CVE-2026-2330 An attacker may access restricted filesystem areas on the device via the CROWN REST interface due to incomplete whitelist enforcement. Certain directories intended for internal testing were not covered by the whitelist and are accessible without auth… Critical Network Exploitable Fri, 06 Mar 2026 07:54:45 GMT https://vulnogram.org/CVE-2026-1627 https://vulnogram.org/CVE-2026-1627 An attacker may exploit the use of outdated and weak MAC algorithms in the device’s SSH service to potentially compromise the integrity of the SSH session, allowing manipulation of transmitted data if the attacker can interact with the network traffi… Medium Network Exploitable Fri, 27 Feb 2026 08:43:30 GMT https://vulnogram.org/CVE-2026-1626 https://vulnogram.org/CVE-2026-1626 An attacker may exploit the use of weak CBC-based cipher suites in the device’s SSH service to potentially observe or manipulate parts of the encrypted SSH communication, if they are able to intercept or interact with the network traffic. Medium Network Exploitable Fri, 27 Feb 2026 08:40:53 GMT https://vulnogram.org/CVE-2026-22646 https://vulnogram.org/CVE-2026-22646 Certain error messages returned by the application expose internal system details that should not be visible to end users, providing attackers with valuable reconnaissance information (like file paths, database errors, or software versions) that can… Medium Thu, 15 Jan 2026 13:15:01 GMT https://vulnogram.org/CVE-2026-22645 https://vulnogram.org/CVE-2026-22645 The application discloses all used components, versions and license information to unauthenticated actors, giving attackers the opportunity to target known security vulnerabilities of used components. Medium Network Exploitable Thu, 15 Jan 2026 13:14:38 GMT https://vulnogram.org/CVE-2026-22644 https://vulnogram.org/CVE-2026-22644 Certain requests pass the authentication token in the URL as string query parameter, making it vulnerable to theft through server logs, proxy logs and Referer headers, which could allow an attacker to hijack the user's session and gain unauthorized a… Medium Network Exploitable Thu, 15 Jan 2026 13:14:13 GMT https://vulnogram.org/CVE-2026-22919 https://vulnogram.org/CVE-2026-22919 An attacker with administrative access may inject malicious content into the login page, potentially enabling cross-site scripting (XSS) attacks, leading to the extraction of sensitive data. Low Thu, 15 Jan 2026 13:08:31 GMT https://vulnogram.org/CVE-2026-22918 https://vulnogram.org/CVE-2026-22918 An attacker may exploit missing protection against clickjacking by tricking users into performing unintended actions through maliciously crafted web pages, leading to the extraction of sensitive data. Medium Network Exploitable Thu, 15 Jan 2026 13:08:02 GMT https://vulnogram.org/CVE-2026-22917 https://vulnogram.org/CVE-2026-22917 Improper input handling in a system endpoint may allow attackers to overload resources, causing a denial of service. Medium Thu, 15 Jan 2026 13:07:41 GMT https://vulnogram.org/CVE-2026-22916 https://vulnogram.org/CVE-2026-22916 An attacker with low privileges may be able to trigger critical system functions such as reboot or factory reset without proper restrictions, potentially leading to service disruption or loss of configuration. Medium Thu, 15 Jan 2026 13:07:07 GMT https://vulnogram.org/CVE-2026-22915 https://vulnogram.org/CVE-2026-22915 An attacker with low privileges may be able to read files from specific directories on the device, potentially exposing sensitive information. Medium Thu, 15 Jan 2026 13:06:44 GMT https://vulnogram.org/CVE-2026-22914 https://vulnogram.org/CVE-2026-22914 An attacker with limited permissions may still be able to write files to specific locations on the device, potentially leading to system manipulation. Medium Thu, 15 Jan 2026 13:06:19 GMT https://vulnogram.org/CVE-2026-22913 https://vulnogram.org/CVE-2026-22913 Improper handling of a URL parameter may allow attackers to execute code in a user's browser after login. This can lead to the extraction of sensitive data. Medium Network Exploitable Thu, 15 Jan 2026 13:05:40 GMT https://vulnogram.org/CVE-2026-22912 https://vulnogram.org/CVE-2026-22912 Improper validation of a login parameter may allow attackers to redirect users to malicious websites after authentication. This can lead to various risk including stealing credentials from unsuspecting users. Medium Network Exploitable Thu, 15 Jan 2026 13:03:15 GMT https://vulnogram.org/CVE-2026-22911 https://vulnogram.org/CVE-2026-22911 Firmware update files may expose password hashes for system accounts, which could allow a remote attacker to recover credentials and gain unauthorized access to the device. Medium Network Exploitable Thu, 15 Jan 2026 13:02:29 GMT https://vulnogram.org/CVE-2026-22910 https://vulnogram.org/CVE-2026-22910 The device is deployed with weak and publicly known default passwords for certain hidden user levels, increasing the risk of unauthorized access. This represents a high risk to the integrity of the system. High Network Exploitable Thu, 15 Jan 2026 13:02:02 GMT https://vulnogram.org/CVE-2026-22909 https://vulnogram.org/CVE-2026-22909 Certain system functions may be accessed without proper authorization, allowing attackers to start, stop, or delete installed applications, potentially disrupting system operations. High Network Exploitable Thu, 15 Jan 2026 13:01:27 GMT https://vulnogram.org/CVE-2026-22908 https://vulnogram.org/CVE-2026-22908 Uploading unvalidated container images may allow remote attackers to gain full access to the system, potentially compromising its integrity and confidentiality. Critical Thu, 15 Jan 2026 13:00:53 GMT https://vulnogram.org/CVE-2026-22907 https://vulnogram.org/CVE-2026-22907 An attacker may gain unauthorized access to the host filesystem, potentially allowing them to read and modify system data. Critical Thu, 15 Jan 2026 12:59:51 GMT https://vulnogram.org/CVE-2025-59463 https://vulnogram.org/CVE-2025-59463 An attacker may cause chunk-size mismatches that block file transfers and prevent subsequent transfers. Medium Mon, 27 Oct 2025 10:14:31 GMT https://vulnogram.org/CVE-2025-59462 https://vulnogram.org/CVE-2025-59462 An attacker who tampers with the C++ CLI client may crash the UpdateService during file transfers, disrupting updates and availability. Medium Mon, 27 Oct 2025 10:12:55 GMT https://vulnogram.org/CVE-2025-59461 https://vulnogram.org/CVE-2025-59461 A remote unauthenticated attacker may use the unauthenticated C++ API to access or modify sensitive data and disrupt services. High Mon, 27 Oct 2025 10:11:46 GMT https://vulnogram.org/CVE-2025-59460 https://vulnogram.org/CVE-2025-59460 The system is deployed in its default state, with configuration settings that do not comply with the latest best practices for restricting access. This increases the risk of unauthorised connections. High Network Exploitable Mon, 27 Oct 2025 10:10:31 GMT https://vulnogram.org/CVE-2025-59459 https://vulnogram.org/CVE-2025-59459 An attacker that gains SSH access to an unprivileged account may be able to disrupt services (including SSH), causing persistent loss of availability. Medium Mon, 27 Oct 2025 10:09:03 GMT https://vulnogram.org/CVE-2025-58579 https://vulnogram.org/CVE-2025-58579 Due to a lack of authentication, it is possible for an unauthenticated user to request data from this endpoint, making the application vulnerable for user enumeration. Medium Network Exploitable Mon, 06 Oct 2025 07:09:09 GMT https://vulnogram.org/CVE-2025-58591 https://vulnogram.org/CVE-2025-58591 A remote, unauthorized attacker can brute force folders and files and read them like private keys or configurations, making the application vulnerable for gathering sensitive information. Medium Mon, 06 Oct 2025 07:07:30 GMT https://vulnogram.org/CVE-2025-58590 https://vulnogram.org/CVE-2025-58590 It's possible to brute force folders and files, what can be used by an attacker to steal sensitve information. Medium Mon, 06 Oct 2025 07:06:26 GMT https://vulnogram.org/CVE-2025-58589 https://vulnogram.org/CVE-2025-58589 When an error occurs in the application a full stacktrace is provided to the user. The stacktrace lists class and method names as well as other internal information. An attacker thus receives information about the technology used and the structure of… Low Mon, 06 Oct 2025 07:03:41 GMT https://vulnogram.org/CVE-2025-58587 https://vulnogram.org/CVE-2025-58587 The application does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame, making it possible for an attacker to guess user credentials. Medium Network Exploitable Mon, 06 Oct 2025 07:03:15 GMT https://vulnogram.org/CVE-2025-58586 https://vulnogram.org/CVE-2025-58586 For failed login attempts, the application returns different error messages depending on whether the login failed due to an incorrect password or a non-existing username. This allows an attacker to guess usernames until they find an existing one. Medium Network Exploitable Mon, 06 Oct 2025 07:02:47 GMT https://vulnogram.org/CVE-2025-58585 https://vulnogram.org/CVE-2025-58585 Multiple endpoints with sensitive information do not require authentication, making the application susceptible to information gathering. Medium Network Exploitable Mon, 06 Oct 2025 07:01:46 GMT https://vulnogram.org/CVE-2025-58584 https://vulnogram.org/CVE-2025-58584 In the HTTP request, the username and password are transferred directly in the URL as parameters. However, URLs can be stored in various systems such as server logs, browser histories or proxy servers. As a result, there is a high risk that this sens… Medium Network Exploitable Mon, 06 Oct 2025 07:01:04 GMT https://vulnogram.org/CVE-2025-58583 https://vulnogram.org/CVE-2025-58583 The application provides access to a login protected H2 database for caching purposes. The username is prefilled. Medium Network Exploitable Mon, 06 Oct 2025 06:52:03 GMT https://vulnogram.org/CVE-2025-58582 https://vulnogram.org/CVE-2025-58582 If a user tries to login but the provided credentials are incorrect a log is created. The data for this POST requests is not validated and it’s possible to send giant payloads which are then logged. Medium Network Exploitable Mon, 06 Oct 2025 06:50:56 GMT https://vulnogram.org/CVE-2025-58581 https://vulnogram.org/CVE-2025-58581 When an error occurs in the application a full stacktrace is provided to the user. The stacktrace lists class and method names as well as other internal information. An attacker can thus obtain information about the technology used and the structure… Medium Mon, 06 Oct 2025 06:50:12 GMT https://vulnogram.org/CVE-2025-58580 https://vulnogram.org/CVE-2025-58580 An API endpoint allows arbitrary log entries to be created via POST request. Without sufficient validation of the input data, an attacker can create manipulated log entries and thus falsify or dilute logs, for example. Medium Network Exploitable Mon, 06 Oct 2025 06:49:27 GMT https://vulnogram.org/CVE-2025-58578 https://vulnogram.org/CVE-2025-58578 A user with the appropriate authorization can create any number of user accounts via an API endpoint using a POST request. There are no quotas, checking mechanisms or restrictions to limit the creation. Low Mon, 06 Oct 2025 06:47:30 GMT https://vulnogram.org/CVE-2025-9914 https://vulnogram.org/CVE-2025-9914 The credentials of the users stored in the system's local database can be used for the log in, making it possible for an attacker to gain unauthorized access. This could potentially affect the confidentiality of the application. Medium Mon, 06 Oct 2025 06:45:59 GMT https://vulnogram.org/CVE-2025-9913 https://vulnogram.org/CVE-2025-9913 JavaScript can be ran inside the address bar via the dashboard "Open in new Tab" Button, making the application vulnerable to session hijacking. Medium Mon, 06 Oct 2025 06:40:49 GMT https://vulnogram.org/CVE-2025-27461 https://vulnogram.org/CVE-2025-27461 During startup, the device automatically logs in the EPC2 Windows user without requesting a password. High Thu, 03 Jul 2025 11:34:52 GMT https://vulnogram.org/CVE-2025-27460 https://vulnogram.org/CVE-2025-27460 The hard drives of the device are not encrypted using a full volume encryption feature such as BitLocker. This allows an attacker with physical access to the device to use an alternative operating system to interact with the hard drives, completely c… High Thu, 03 Jul 2025 11:34:21 GMT https://vulnogram.org/CVE-2025-27459 https://vulnogram.org/CVE-2025-27459 The VNC application stores its passwords encrypted within the registry but uses DES for encryption. As DES is broken, the original passwords can be recovered. Medium Thu, 03 Jul 2025 11:33:53 GMT https://vulnogram.org/CVE-2025-27458 https://vulnogram.org/CVE-2025-27458 The VNC authentication mechanism bases on a challenge-response system where both server and client use the same password for encryption. The challenge is sent from the server to the client, is encrypted by the client and sent back. The server does th… Medium Network Exploitable Thu, 03 Jul 2025 11:33:30 GMT https://vulnogram.org/CVE-2025-27457 https://vulnogram.org/CVE-2025-27457 All communication between the VNC server and client(s) is unencrypted. This allows an attacker to intercept the traffic and obtain sensitive data. Medium Network Exploitable Thu, 03 Jul 2025 11:32:59 GMT https://vulnogram.org/CVE-2025-27456 https://vulnogram.org/CVE-2025-27456 The SMB server's login mechanism does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame, making it susceptible to brute-force attacks. High Network Exploitable Thu, 03 Jul 2025 11:32:21 GMT https://vulnogram.org/CVE-2025-27455 https://vulnogram.org/CVE-2025-27455 The web application is vulnerable to clickjacking attacks. The site can be embedded into another frame, allowing an attacker to trick a user into clicking on something different from what the user perceives, thus potentially revealing confidential in… Medium Network Exploitable Thu, 03 Jul 2025 11:30:49 GMT