{
  "document": {
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en-US",
    "notes": [
      {
        "category": "summary",
        "text": "Multiple internal virtual filesystem paths are unintentionally accessible remotely in the SICK InspectorP6xx devices. If exploited, this vulnerability could potentially allow an unauthenticated attacker to compromise the availability, integrity, and confidentiality of the devices.",
        "title": "summary"
      },
      {
        "category": "general",
        "text": "As general security measures, SICK recommends minimizing network exposure of the devices, restricting network access and following recommended security practices in order to run the devices in a protected IT environment.",
        "title": "General Security Measures"
      },
      {
        "category": "general",
        "text": "SICK performs vulnerability classification by using the CVSS scoring system (*CVSS v3.1*). The environmental score is dependent on the customer\u2019s environment and can affect the overall CVSS score. SICK recommends that customers individually evaluate the environmental score to achieve final scoring.",
        "title": "Vulnerability Classification"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "psirt@sick.de",
      "issuing_authority": "SICK AG issues and issues in EHS products (when related to the Endress+Hauser SICK (EHS) joint venture).",
      "name": "SICK PSIRT",
      "namespace": "https://www.sick.com/psirt"
    },
    "references": [
      {
        "summary": "SICK PSIRT Security Advisories",
        "url": "https://www.sick.com/psirt"
      },
      {
        "summary": "SICK Operating Guidelines",
        "url": "https://www.sick.com/media/docs/9/19/719/special_information_sick_operating_guidelines_cybersecurity_by_sick_en_im0106719.pdf"
      },
      {
        "summary": "ICS-CERT recommended practices on Industrial Security",
        "url": "https://www.cisa.gov/resources-tools/resources/ics-recommended-practices"
      },
      {
        "summary": "CVSS v3.1 Calculator",
        "url": "https://www.first.org/cvss/calculator/3.1"
      },
      {
        "category": "self",
        "summary": "The canonical URL.",
        "url": "https://www.sick.com/.well-known/csaf/white/2026/sca-2026-0008.json"
      }
    ],
    "title": "AppEngine vulnerability affects SICK InspectorP6xx devices",
    "tracking": {
      "current_release_date": "2026-07-28T12:47:00.000Z",
      "generator": {
        "date": "2026-07-20T12:30:23.840Z",
        "engine": {
          "name": "Secvisogram",
          "version": "2.6.6"
        }
      },
      "id": "sca-2026-0010",
      "initial_release_date": "2026-07-28T12:47:00.000Z",
      "revision_history": [
        {
          "date": "2026-07-28T12:47:00.000Z",
          "number": "1",
          "summary": "Initial version"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "branches": [
                  {
                    "category": "product_version_range",
                    "name": "vers:all/*",
                    "product": {
                      "name": "SICK InspectorP61x all versions",
                      "product_id": "CSAFPID-11000",
                      "product_identification_helper": {
                        "skus": [
                          "1124942",
                          "1124949",
                          "1124943",
                          "1124948",
                          "1142000",
                          "1124947",
                          "1142001",
                          "1124946",
                          "1143233",
                          "1143232",
                          "1114809",
                          "1116350"
                        ]
                      }
                    }
                  }
                ],
                "category": "product_name",
                "name": "InspectorP61x"
              },
              {
                "branches": [
                  {
                    "category": "product_version_range",
                    "name": "vers:all/*",
                    "product": {
                      "name": "SICK InspectorP62x all versions",
                      "product_id": "CSAFPID-11001",
                      "product_identification_helper": {
                        "skus": [
                          "1111871",
                          "1110848",
                          "1130942",
                          "1154202",
                          "1110849",
                          "1111870",
                          "1110847",
                          "1154203",
                          "1121695",
                          "1121694",
                          "1156218",
                          "1118465",
                          "1118466",
                          "1156219"
                        ]
                      }
                    }
                  }
                ],
                "category": "product_name",
                "name": "InspectorP62x"
              },
              {
                "branches": [
                  {
                    "category": "product_version_range",
                    "name": "vers:all/*",
                    "product": {
                      "name": "SICK InspectorP65x all versions",
                      "product_id": "CSAFPID-11002",
                      "product_identification_helper": {
                        "skus": [
                          "1073669",
                          "1073670",
                          "1082303",
                          "1082304",
                          "1082305",
                          "1082306"
                        ]
                      }
                    }
                  }
                ],
                "category": "product_name",
                "name": "InspectorP65x"
              },
              {
                "branches": [
                  {
                    "category": "product_version_range",
                    "name": "vers:all/*",
                    "product": {
                      "name": "SICK InspectorP63x all versions",
                      "product_id": "CSAFPID-11003",
                      "product_identification_helper": {
                        "skus": [
                          "1082298",
                          "1082299",
                          "1082300",
                          "1082301",
                          "1101157",
                          "1101640"
                        ]
                      }
                    }
                  }
                ],
                "category": "product_name",
                "name": "InspectorP63x"
              },
              {
                "branches": [
                  {
                    "category": "product_version_range",
                    "name": "vers:all/*",
                    "product": {
                      "name": "SICK InspectorP64x all versions",
                      "product_id": "CSAFPID-11004",
                      "product_identification_helper": {
                        "skus": [
                          "1075507",
                          "1082302"
                        ]
                      }
                    }
                  }
                ],
                "category": "product_name",
                "name": "InspectorP64x"
              }
            ],
            "category": "product_family",
            "name": "Inspector"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c 5.4.0",
                "product": {
                  "name": "SICK InspectorP61x firmware \u003c 5.4.0",
                  "product_id": "CSAFPID-21000"
                }
              },
              {
                "category": "product_version",
                "name": "5.4.0",
                "product": {
                  "name": "SICK InspectorP61x firmware 5.4.0",
                  "product_id": "CSAFPID-22000"
                }
              }
            ],
            "category": "product_name",
            "name": "InspectorP61x firmware"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c 5.4.0",
                "product": {
                  "name": "SICK InspectorP62x firmware \u003c 5.4.0",
                  "product_id": "CSAFPID-21002"
                }
              },
              {
                "category": "product_version",
                "name": "5.4.0",
                "product": {
                  "name": "SICK InspectorP62x firmware 5.4.0",
                  "product_id": "CSAFPID-22002"
                }
              }
            ],
            "category": "product_name",
            "name": "InspectorP62x firmware"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:all/*",
                "product": {
                  "name": "SICK InspectorP65x firmware all versions",
                  "product_id": "CSAFPID-21003"
                }
              }
            ],
            "category": "product_name",
            "name": "InspectorP65x firmware"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:all/*",
                "product": {
                  "name": "SICK InspectorP63x firmware all versions",
                  "product_id": "CSAFPID-21004"
                }
              }
            ],
            "category": "product_name",
            "name": "InspectorP63x firmware"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:all/*",
                "product": {
                  "name": "SICK InspectorP64x firmware all versions",
                  "product_id": "CSAFPID-21005"
                }
              }
            ],
            "category": "product_name",
            "name": "InspectorP64x firmware"
          }
        ],
        "category": "vendor",
        "name": "SICK AG"
      }
    ],
    "relationships": [
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "SICK InspectorP61x with firmware \u003c 5.4.0",
          "product_id": "CSAFPID-31000"
        },
        "product_reference": "CSAFPID-21000",
        "relates_to_product_reference": "CSAFPID-11000"
      },
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "SICK InspectorP62x with firmware \u003c 5.4.0",
          "product_id": "CSAFPID-31002"
        },
        "product_reference": "CSAFPID-21002",
        "relates_to_product_reference": "CSAFPID-11001"
      },
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "SICK InspectorP65x all firmware versions",
          "product_id": "CSAFPID-31003"
        },
        "product_reference": "CSAFPID-21003",
        "relates_to_product_reference": "CSAFPID-11002"
      },
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "SICK InspectorP63x all firmware versions",
          "product_id": "CSAFPID-31004"
        },
        "product_reference": "CSAFPID-21004",
        "relates_to_product_reference": "CSAFPID-11003"
      },
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "SICK InspectorP64x all firmware versions",
          "product_id": "CSAFPID-31005"
        },
        "product_reference": "CSAFPID-21005",
        "relates_to_product_reference": "CSAFPID-11004"
      },
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "SICK InspectorP61x with firmware 5.4.0",
          "product_id": "CSAFPID-32000"
        },
        "product_reference": "CSAFPID-22000",
        "relates_to_product_reference": "CSAFPID-11000"
      },
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "SICK InspectorP62x with firmware 5.4.0",
          "product_id": "CSAFPID-32002"
        },
        "product_reference": "CSAFPID-22002",
        "relates_to_product_reference": "CSAFPID-11001"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-11841",
      "cwe": {
        "id": "CWE-552",
        "name": "Files or Directories Accessible to External Parties"
      },
      "notes": [
        {
          "audience": "all",
          "category": "summary",
          "text": "A vulnerability has been identified in the SOPAS FileSystemAccess method that allows unintended remote access to internal virtual filesystem paths. Due to insufficient access restrictions, an attacker with network access can query and modify internal storage locations, configuration files, and system-related application directories. This exposure may lead to the Denial of Service, unauthorized change of device configuration or disclosure of sensitive system information that could facilitate further attacks or compromise of the device.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "fixed": [
          "CSAFPID-32000",
          "CSAFPID-32002"
        ],
        "known_affected": [
          "CSAFPID-31000",
          "CSAFPID-31002",
          "CSAFPID-31003",
          "CSAFPID-31004",
          "CSAFPID-31005"
        ],
        "recommended": [
          "CSAFPID-32000",
          "CSAFPID-32002"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-06-17T12:47:21.218Z",
          "details": "Users are recommended to upgrade to version 5.4.0.",
          "product_ids": [
            "CSAFPID-31000",
            "CSAFPID-31002"
          ]
        },
        {
          "category": "mitigation",
          "date": "2026-06-17T12:47:21.218Z",
          "details": "Please make sure that only trusted entities have access to the device. Furthermore, you should apply the following General Security Measures when operating the product to mitigate the associated security risk. The collected resources \u201dSICK Operating Guidelines\u201d and \u201dICS-CERT recommended practices on Industrial Security\u201d could help to implement the general security practices.",
          "product_ids": [
            "CSAFPID-31003",
            "CSAFPID-31004",
            "CSAFPID-31005"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 9.4,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "environmentalScore": 9.4,
            "environmentalSeverity": "CRITICAL",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "temporalScore": 9.4,
            "temporalSeverity": "CRITICAL",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-31000",
            "CSAFPID-31002",
            "CSAFPID-31003",
            "CSAFPID-31004",
            "CSAFPID-31005"
          ]
        }
      ],
      "title": "CVE-2026-11841"
    }
  ]
}