PT-2026-65430 · Sick Ag · Inspectorp61X+4

CVE-2026-11841 · Publicado 2026-07-28 · Atualizado 2026-07-28

Mitre

CVSS v3.1

9.4

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L

An attacker may perform unauthenticated read and write operations on sensitive filesystem areas via the AppEngine Fileaccess over HTTP due to improper access restrictions. A critical filesystem directory was unintentionally exposed through the HTTP-based file access feature, allowing access without authentication. This includes device parameter files, enabling an attacker to read and modify application settings, including customer-defined passwords. Additionally, exposure of the custom application directory may allow execution of arbitrary Lua code within the sandboxed AppEngine environment.

Correção

Files Accessible to External Parties

Enumeração de Fraquezas

CWE-552

Identificadores relacionados

CVE-2026-11841

Produtos afetados

Inspectorp61X

Inspectorp62X

Inspectorp63X

Inspectorp64X

Inspectorp65X

Referências · 7

• https://first.org/cvss/calculator/3.1 · Nota
• https://sick.com/.well-known/csaf/white/2026/sca-2026-0010.json · Nota
• https://cisa.gov/resources-tools/resources/ics-recommended-practices · Nota
• https://sick.com/.well-known/csaf/white/2026/sca-2026-0010.pdf · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2026-11841 · Nota de Segurança
• https://sick.com/media/docs/9/19/719/special_information_sick_operating_guidelines_cybersecurity_by_sick_en_im0106719.pdf · Nota
• https://sick.com/psirt · Nota