CVE-2026-2331

CRITICAL 9.8

CVE-2026-2331

CVSS Score

9.8

EPSS Score

0.0%

EPSS Percentile

0th

An attacker may perform unauthenticated read and write operations on sensitive filesystem areas via the AppEngine Fileaccess over HTTP due to improper access restrictions. A critical filesystem directory was unintentionally exposed through the HTTP-based file access feature, allowing access without authentication. This includes device parameter files, enabling an attacker to read and modify application settings, including customer-defined passwords. Additionally, exposure of the custom application directory may allow execution of arbitrary Lua code within the sandboxed AppEngine environment.

CWE	CWE-552
Vendor	sick ag
Product	sick lector85x
Published	Mar 6, 2026
Last Updated	Mar 9, 2026

Stay Ahead of the Next One

Get instant alerts for sick ag sick lector85x

Be the first to know when new critical vulnerabilities affecting sick ag sick lector85x are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Affected Versions

SICK AG / SICK Lector85x

2.6.0 ≤ 2.7.0

SICK AG / SICK Lector83x

2.6.0 ≤ 2.7.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

sick.com: https://www.sick.com/psirt sick.com: https://www.sick.com/media/docs/9/19/719/special_information_sick_operating_guidelines_cybersecurity_by_sick_en_im0106719.pdf cisa.gov: https://www.cisa.gov/resources-tools/resources/ics-recommended-practices first.org: https://www.first.org/cvss/calculator/3.1 sick.com: https://www.sick.com/.well-known/csaf/white/2026/sca-2026-0006.json sick.com: https://www.sick.com/.well-known/csaf/white/2026/sca-2026-0006.pdf