{
  "document": {
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en-US",
    "notes": [
      {
        "category": "summary",
        "text": "The Device Manager extension shipped with Sentio Creator is affected by CVE-2026-80469. Affected versions are pre-installed in Sentio Creator releases up to and including version 2026.2. As the Device Manager extension can be updated independently of Sentio Creator, SICK recommends applying the defined remediations for this vulnerability.",
        "title": "summary"
      },
      {
        "category": "general",
        "text": "As general security measures, SICK recommends minimizing network exposure of the devices, restricting network access and following recommended security practices in order to run the devices in a protected IT environment.",
        "title": "General Security Measures"
      },
      {
        "category": "general",
        "text": "SICK performs vulnerability classification by using the CVSS scoring system (*CVSS v3.1*). The environmental score is dependent on the customer\u2019s environment and can affect the overall CVSS score. SICK recommends that customers individually evaluate the environmental score to achieve final scoring.",
        "title": "Vulnerability Classification"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "psirt@sick.de",
      "issuing_authority": "SICK AG issues and issues in EHS products (when related to the Endress+Hauser SICK (EHS) joint venture).",
      "name": "SICK PSIRT",
      "namespace": "https://www.sick.com/psirt"
    },
    "references": [
      {
        "summary": "SICK PSIRT Security Advisories",
        "url": "https://www.sick.com/psirt"
      },
      {
        "summary": "SICK Operating Guidelines",
        "url": "https://www.sick.com/media/docs/9/19/719/special_information_sick_operating_guidelines_cybersecurity_by_sick_en_im0106719.pdf"
      },
      {
        "summary": "ICS-CERT recommended practices on Industrial Security",
        "url": "https://www.cisa.gov/resources-tools/resources/ics-recommended-practices"
      },
      {
        "summary": "CVSS v3.1 Calculator",
        "url": "https://www.first.org/cvss/calculator/3.1"
      },
      {
        "category": "self",
        "summary": "The canonical URL.",
        "url": "https://www.sick.com/.well-known/csaf/white/2026/sca-2026-0012.json"
      }
    ],
    "title": "Vulnerability Affecting Sentio Creator Extension \u0027Device Manager\u0027",
    "tracking": {
      "current_release_date": "2026-11-13T15:18:31.000Z",
      "generator": {
        "date": "2026-09-04T07:19:35.773Z",
        "engine": {
          "name": "Secvisogram",
          "version": "2.6.11"
        }
      },
      "id": "SCA-2026-0012",
      "initial_release_date": "2026-09-11T13:00:00.000Z",
      "revision_history": [
        {
          "date": "2026-09-11T13:00:00.000Z",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-11-13T15:18:31.000Z",
          "number": "2",
          "summary": "Corrected initial_release_date to match the date of the initial revision (revision 1). No changes to vulnerability, product, or remediation information."
        }
      ],
      "status": "final",
      "version": "2"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "branches": [
                  {
                    "category": "product_version_range",
                    "name": "\u003c=1.4",
                    "product": {
                      "name": "Sentio Creator \u003c=2026.2 using Device Manager \u003c=1.4",
                      "product_id": "CSAFPID-51000"
                    }
                  },
                  {
                    "category": "product_version",
                    "name": "1.4.1",
                    "product": {
                      "name": "Sentio Creator \u003c=2026.2 using Device Manager 1.4.1",
                      "product_id": "CSAFPID-52000"
                    }
                  }
                ],
                "category": "product_name",
                "name": "Sentio Creator"
              }
            ],
            "category": "product_family",
            "name": "Engineering Tools"
          }
        ],
        "category": "vendor",
        "name": "SICK AG"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-80469",
      "cwe": {
        "id": "CWE-347",
        "name": "Improper Verification of Cryptographic Signature"
      },
      "notes": [
        {
          "audience": "all",
          "category": "summary",
          "text": "An attacker may achieve arbitrary code execution on a target system by uploading a malicious device driver package, bypassing driver verification mechanisms, and triggering the execution of attacker-controlled code. User interaction is required.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "fixed": [
          "CSAFPID-52000"
        ],
        "known_affected": [
          "CSAFPID-51000"
        ],
        "recommended": [
          "CSAFPID-52000"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-26T15:53:04.548Z",
          "details": "Users are strongly recommended to upgrade the Device Manager extension for Sentio Creator to version 1.4.1.",
          "product_ids": [
            "CSAFPID-51000"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.3,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "environmentalScore": 8.4,
            "environmentalSeverity": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "temporalScore": 8.3,
            "temporalSeverity": "HIGH",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-51000"
          ]
        }
      ],
      "title": "CVE-2026-80469"
    }
  ]
}