SICK AG vulnerabilities
Published CVEs affecting SICK AG products: 33 record(s), with severity, exploitation and fixes.
TDC-X401GL 13Tdc-x401gl Firmware 13Tloc100-100 Firmware 5Enterprise Analytics 5TLOC100-100 all Firmware versions 3Incoming Goods Suite 3SICK MRS1000 2SICK LMS1000 2SICK Lector83x 2SICK Lector85x 2Mrs1000 Firmware 2Lms1000 Firmware 2TLOC100-100 1TLOC100-100 with Firmware <7.1.1 1Sick Safetyscanners Base CPP Driver 1InspectorP61x 1InspectorP62x 1InspectorP65x 1InspectorP63x 1InspectorP64x 1ICR890-4 1Sentio Creator Extension 'Device Manager' 1
CVE-2025-59460
High · 7.5
CWE-1391 Oct 27, 2025
Unsecure access configuration
The system is deployed in its default state, with configuration settings that do not comply with the latest best practices for restricting access. This increases the risk of unauthorised connections.
CVE-2025-59461
Critical · 9.8
CWE-862 Oct 27, 2025
API does not require authentication
A remote unauthenticated attacker may use the unauthenticated C++ API to access or modify sensitive data and disrupt services.
CVE-2025-59459
High · 7.5
CWE-770 Oct 27, 2025
Denial-of-service (DoS) via resource consumption
An attacker that gains SSH access to an unprivileged account may be able to disrupt services (including SSH), causing persistent loss of availability.
CVE-2025-58583
Medium · 5.3
CWE-497 Oct 6, 2025
User Enumeration
The application provides access to a login protected H2 database for caching purposes. The username is prefilled.
CVE-2025-58582
High · 7.5
CWE-770 Oct 6, 2025
Uncontrolled Resource Consumption via log file
If a user tries to login but the provided credentials are incorrect a log is created. The data for this POST requests is not validated and it’s possible to send giant payloads which are then logged.
CVE-2025-58581
Medium · 4.3
CWE-200 Oct 6, 2025
Information Disclosure Through Stacktrace-/MQTT/Config/changeAll
When an error occurs in the application a full stacktrace is provided to the user. The stacktrace lists class and method names as well as other internal information. An attacker can thus obtain information about the technology used and the structure of the application.
CVE-2025-58580
Medium · 5.3
CWE-117 Oct 6, 2025
Injection via log file
An API endpoint allows arbitrary log entries to be created via POST request. Without sufficient validation of the input data, an attacker can create manipulated log entries and thus falsify or dilute logs, for example.
CVE-2025-58578
Medium · 4.3
CWE-770 Oct 6, 2025
Unlimited user creation by authorized users
A user with the appropriate authorization can create any number of user accounts via an API endpoint using a POST request. There are no quotas, checking mechanisms or restrictions to limit the creation.