CVE-2026-11841

CRITICAL 9.4

CVE-2026-11841

CVSS Score

9.4

EPSS Score

0.0%

EPSS Percentile

0th

An attacker may perform unauthenticated read and write operations on sensitive filesystem areas via the AppEngine Fileaccess over HTTP due to improper access restrictions. A critical filesystem directory was unintentionally exposed through the HTTP-based file access feature, allowing access without authentication. This includes device parameter files, enabling an attacker to read and modify application settings, including customer-defined passwords. Additionally, exposure of the custom application directory may allow execution of arbitrary Lua code within the sandboxed AppEngine environment.

CWE	CWE-552
Vendor	sick ag
Product	inspectorp61x
Published	Jul 28, 2026

Stay Ahead of the Next One

Get instant alerts for sick ag inspectorp61x

Be the first to know when new critical vulnerabilities affecting sick ag inspectorp61x are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

Low

Affected Versions

SICK AG / InspectorP61x

0 < 5.4.0

SICK AG / InspectorP62x

0 < 5.4.0

SICK AG / InspectorP65x

all versions

SICK AG / InspectorP63x

all versions

SICK AG / InspectorP64x

all versions

References

NVD ↗ CVE.org ↗ EPSS Data ↗

sick.com: https://www.sick.com/psirt sick.com: https://www.sick.com/media/docs/9/19/719/special_information_sick_operating_guidelines_cybersecurity_by_sick_en_im0106719.pdf cisa.gov: https://www.cisa.gov/resources-tools/resources/ics-recommended-practices first.org: https://www.first.org/cvss/calculator/3.1 sick.com: https://www.sick.com/.well-known/csaf/white/2026/sca-2026-0010.json sick.com: https://www.sick.com/.well-known/csaf/white/2026/sca-2026-0010.pdf