PT-2026-65430 · Sick Ag · Inspectorp61X+4

CVE-2026-11841 · Published 2026-07-28 · Updated 2026-07-28

Mitre

CVSS v3.1

9.4

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L

An attacker may perform unauthenticated read and write operations on sensitive filesystem areas via the AppEngine Fileaccess over HTTP due to improper access restrictions. A critical filesystem directory was unintentionally exposed through the HTTP-based file access feature, allowing access without authentication. This includes device parameter files, enabling an attacker to read and modify application settings, including customer-defined passwords. Additionally, exposure of the custom application directory may allow execution of arbitrary Lua code within the sandboxed AppEngine environment.

Fix

Files Accessible to External Parties

Weakness Enumeration

CWE-552

Related Identifiers

CVE-2026-11841

Affected Products

Inspectorp61X

Inspectorp62X

Inspectorp63X

Inspectorp64X

Inspectorp65X

References · 7

• https://sick.com/.well-known/csaf/white/2026/sca-2026-0010.pdf · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-11841 · Security Note
• https://first.org/cvss/calculator/3.1 · Note
• https://sick.com/.well-known/csaf/white/2026/sca-2026-0010.json · Note
• https://cisa.gov/resources-tools/resources/ics-recommended-practices · Note
• https://sick.com/media/docs/9/19/719/special_information_sick_operating_guidelines_cybersecurity_by_sick_en_im0106719.pdf · Note
• https://sick.com/psirt · Note