CVE-2026-11841
Description
An attacker may perform unauthenticated read and write operations on sensitive filesystem areas via the AppEngine Fileaccess over HTTP due to improper access restrictions. A critical filesystem directory was unintentionally exposed through the HTTP-based file access feature, allowing access without authentication. This includes device parameter files, enabling an attacker to read and modify application settings, including customer-defined passwords. Additionally, exposure of the custom application directory may allow execution of arbitrary Lua code within the sandboxed AppEngine environment.
How to fix
- SICK AG InspectorP61x5.4.0 or later
- SICK AG InspectorP62x5.4.0 or later
- SICK AG ICR890-42.15.0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| SICK AG InspectorP61x | v < 5.4.0 | 5.4.0 |
| SICK AG InspectorP62x | v < 5.4.0 | 5.4.0 |
| SICK AG InspectorP65x | No range specified | — |
| SICK AG InspectorP63x | No range specified | — |
| SICK AG InspectorP64x | No range specified | — |
| SICK AG ICR890-4 | v < 2.15.0 | 2.15.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.