CVE-2026-11841: Sick AG ICR890-4

Critical severity, CVSS 9.4. EPSS: 0.9% chance of exploitation in the next 30 days.

An attacker may perform unauthenticated read and write operations on sensitive filesystem areas via the AppEngine Fileaccess over HTTP due to improper access restrictions. A critical filesystem directory was unintentionally exposed through the HTTP-based file access feature, allowing access without authentication. This includes device parameter files, enabling an attacker to read and modify application settings, including customer-defined passwords. Additionally, exposure of the custom application directory may allow execution of arbitrary Lua code within the sandboxed AppEngine environment.

Affected products

• Sick AG ICR890-4: before 2.15.0 (fixed in 2.15.0)
• Sick AG INSPECTORP61X: before 5.4.0 (fixed in 5.4.0)
• Sick AG INSPECTORP62X: before 5.4.0 (fixed in 5.4.0)
• Sick AG INSPECTORP63X: any version
• Sick AG INSPECTORP64X: any version
• Sick AG INSPECTORP65X: any version

Published 2026-07-28. Last modified 2026-09-09.