SICK vulnerabilities
We track 83 vulnerabilities in SICK products across 60+ products. 83 are rated high or critical, and none are known to be exploited. The most recent was published on October 15, 2026.
Latest SICK vulnerabilities
- 8.8 High severity
SICK InspectorP61x: Reliance on Obfuscation or Encryption of Security-Relevant Inputs without Integrity Checking
Since the firmware update is not validated, an attacker can install modified firmware on the device. This has a high impact on the availabilty, integrity and confidentiality up to the complete compromise of the device.
- 8.8 High severity
SICK InspectorP61x: Improper Control of Generation of Code
Due to missing input validation during one step of the firmware update process, the product is vulnerable to remote code execution. With network access and the user level ”Service”, an attacker can execute arbitrary system commands in the root user’s contexts.
- 8.8 High severity
SICK Incoming Goods Suite: Execution with Unnecessary Privileges
A vulnerability in the Incoming Goods Suite allows a user with unprivileged access to the underlying system (e.g. local or via SSH) a privilege escalation to the administrative level due to the usage of component vendor Docker images running with root permissi
- 9.1 Critical severity
SICK CLV6xx: Use of Hard-coded Credentials
A vulnerability in the .sdd file allows an attacker to read default passwords stored in plain text within the code. By exploiting these plaintext credentials, an attacker can log into affected SICK products as an “Authorized Client” if the customer has not cha
- 7.5 High severity
MSC800: Missing Authentication for Critical Functionality
A vulnerability allows a remote unauthenticated attacker to modify the prod uct’s IP address over the Sopas ET interface. This can lead to a Denial of Service attack.
- 8.8 High severity
FX0-GMOD00000: Improper Authentication
Authentication Bypass by Capture-replay in SICK Flexi Soft Gateways with Partnumbers 1044073, 1127717, 1130282, 1044074, 1121597, 1099832, 1051432, 1127487, 1069070, 1112296, 1044072, 1121596, 1099830 allows an unauthenticated remote attacker to potentially im
- 7.5 High severity
APU0200: Missing Authorization
Missing Authorization in RDT400 in SICK APU allows an unprivileged remote attacker to modify data via HTTP requests that no not require authentication.
- 7.5 High severity
APU0200: Improper Restriction of Excessive Authentication Attempts
Improper Restriction of Excessive Authentication Attempts in RDT400 in SICK APU allows an unprivileged remote attacker to guess the password via trial-and-error as the login attempts are not limited.
- 9.8 Critical severity
APU0200: Unrestricted Upload of File with Dangerous Type
Improper Access Control in SICK APU allows an unprivileged remote attacker to download as well as upload arbitrary files via anonymous access to the FTP server.
- 9.8 Critical severity
SIM1012: Improper Access Control
A remote unauthorized attacker may connect to the SIM1012, interact with the device and change configuration settings. The adversary may also reset the SIM and in the worst case upload a new firmware version to the device.
- 7.4 High severity
LMS5xx: Missing Encryption of Sensitive Data
A remote unprivileged attacker can intercept the communication via e.g. Man-In-The-Middle, due to the absence of Transport Layer Security (TLS) in the SICK LMS5xx. This lack of encryption in the communication channel can lead to the unauthorized disclosure of
- 8.8 High severity
LMS5xx: Use of Hard-coded Credentials
The LMS5xx uses hard-coded credentials, which potentially allow low-skilled unauthorized remote attackers to reconfigure settings and /or disrupt the functionality of the device.
- 7.5 High severity
LMS5xx: Uncontrolled Resource Consumption
A remote unprivileged attacker can sent multiple packages to the LMS5xx to disrupt its availability through a TCP SYN-based denial-of-service (DDoS) attack. By exploiting this vulnerability, an attacker can flood the targeted LMS5xx with a high volume of TCP S
- 7.5 High severity
LMS5xx: Use of Password Hash With Insufficient Computational Effort
The LMS5xx uses weak hash generation methods, resulting in the creation of insecure hashs. If an attacker manages to retrieve the hash, it could lead to collision attacks and the potential retrieval of the password.
- 7.5 High severity
ICR890-4: Improper Access Control
Improper Access Control in the SICK ICR890-4 could allow an unauthenticated remote attacker to affect the availability of the device by changing settings of the device such as the IP address based on missing access control.
- 7.5 High severity
ICR890-4: Cleartext Transmission of Sensitive Information
Cleartext Transmission of Sensitive Information in the SICK ICR890-4 could allow a remote attacker to gather sensitive information by intercepting network traffic that is not encrypted.
- 7.5 High severity
ICR890-4: Improper Access Control
Improper Access Control in the SICK ICR890-4 could allow an unauthenticated remote attacker to gather information about the system and download data via the REST API by accessing unauthenticated endpoints.
- 7.5 High severity
ICR890-4: Exposure of Resource to Wrong Sphere
Exposure of Sensitive Information to an Unauthorized Actor in the SICK ICR890-4 could allow an unauthenticated remote attacker to retrieve sensitive information about the system.
- 7.5 High severity
ICR890-4: Exposure of Resource to Wrong Sphere
Unauthenticated endpoints in the SICK ICR890-4 could allow an unauthenticated remote attacker to retrieve sensitive information about the device via HTTP requests.
- 9.8 Critical severity
EventCam App: Missing Authentication for Critical Functionality
A remote unprivileged attacker can modify and access configuration settings on the EventCam App due to the absence of API authentication. The lack of authentication in the API allows the attacker to potentially compromise the functionality of the EventCam App.
- 7.4 High severity
EventCam App: Cleartext Transmission of Sensitive Information
A remote unprivileged attacker can intercept the communication via e.g. Man-In-The-Middle, due to the absence of Transport Layer Security (TLS) in the SICK EventCam App. This lack of encryption in the communication channel can lead to the unauthorized disclosu
- 7.5 High severity
SICK FTMG-ESD15AXX AIR FLOW SENSOR: Uncontrolled Resource Consumption
Uncontrolled Resource Consumption in SICK FTMg AIR FLOW SENSOR with Partnumbers 1100214, 1100215, 1100216, 1120114, 1120116, 1122524, 1122526 allows an remote attacker to influence the availability of the webserver by invocing a Slowloris style attack via HTTP
- 7.5 High severity
SICK FTMG-ESD15AXX AIR FLOW SENSOR: Cleartext Storage of Sensitive Information
Cleartext Storage of Sensitive Information in SICK FTMg AIR FLOW SENSOR with Partnumbers 1100214, 1100215, 1100216, 1120114, 1120116, 1122524, 1122526 allows a remote attacker to potentially steal user credentials that are stored in the user’s browsers local s
- 9.8 Critical severity
SICK FTMG-ESD15AXX AIR FLOW SENSOR: Improper Authentication
Use of Password Hash Instead of Password for Authentication in SICK FTMg AIR FLOW SENSOR with Partnumbers 1100214, 1100215, 1100216, 1120114, 1120116, 1122524, 1122526 allows an unprivileged remote attacker to use a password hash instead of an actual password
- 7.5 High severity
SICK FTMG-ESD15AXX AIR FLOW SENSOR: Uncontrolled Resource Consumption
Uncontrolled Resource Consumption in SICK FTMg AIR FLOW SENSOR with Partnumbers 1100214, 1100215, 1100216, 1120114, 1120116, 1122524, 1122526 allows an unprivileged remote attacker to influence the availability of the webserver by invocing several open file re
- 7.5 High severity
SICK FTMG-ESD15AXX AIR FLOW SENSOR: Incorrect Authorization
Improper Access Control in SICK FTMg AIR FLOW SENSOR with Partnumbers 1100214, 1100215, 1100216, 1120114, 1120116, 1122524, 1122526 allows an unprivileged remote attacker to download files by using a therefore unpriviledged account via the REST interface.
- 7.5 High severity
SICK FTMG-ESD15AXX AIR FLOW SENSOR: Incorrect Authorization
Improper Access Control in SICK FTMg AIR FLOW SENSOR with Partnumbers 1100214, 1100215, 1100216, 1120114, 1120116, 1122524, 1122526 allows an unprivileged remote attacker to gain unauthorized access to data fields by using a therefore unpriviledged account via
- 8.2 High severity
UE410-EN3 FLEXI ETHERNET GATEW.: Missing Authentication for Critical Functionality
Missing Authentication for Critical Function in SICK Flexi Classic and Flexi Soft Gateways with Partnumbers 1042193, 1042964, 1044078, 1044072, 1044073, 1044074, 1099830, 1099832, 1127717, 1069070, 1112296, 1051432, 1102420, 1127487, 1121596, 1121597 allows an
- 9.8 Critical severity
SICK FX0-GENT00000, SICK FX0-GENT00030, SICK…: Missing Authentication for Critical Functionality
The Flexi Classic and Flexi Soft Gateways SICK UE410-EN3 FLEXI ETHERNET GATEW. with serial number <=2311xxxx all Firmware versions, SICK UE410-EN1 FLEXI ETHERNET GATEW. with serial number <=2311xxxx all Firmware versions, SICK UE410-EN3S04 FLEXI ETHERNET GATEW
- 9.8 Critical severity
FX0-GENT v3 Firmware: Missing Authentication for Critical Functionality
Missing Authentication for Critical Function in SICK FX0-GENT v3 Firmware Version V3.04 and V3.05 allows an unprivileged remote attacker to achieve arbitrary remote code execution via maliciously crafted RK512 commands to the listener on TCP port 9000.
- 9.8 Critical severity
FX0-GPNT v3 Firmware: Missing Authentication for Critical Functionality
Missing Authentication for Critical Function in SICK FX0-GPNT v3 Firmware Version V3.04 and V3.05 allows an unprivileged remote attacker to achieve arbitrary remote code execution via maliciously crafted RK512 commands to the listener on TCP port 9000.
- 9.8 Critical severity
SICK SIM2000ST (LFT PPC): Missing Authentication for Critical Functionality
Password recovery vulnerability in SICK SIM2000ST Partnumber 2086502 with firmware version <1.13.4 allows an unprivileged remote attacker to gain access to the userlevel defined as RecoverableUserLevel by invocating the password recovery mechanism method. This
- 7.3 High severity
SICK SIM1012: Missing Authentication for Critical Functionality
Password recovery vulnerability in SICK SIM1012 Partnumber 1098146 with firmware version <2.2.0 allows an unprivileged remote attacker to gain access to the userlevel defined as RecoverableUserLevel by invocating the password recovery mechanism method. This le
- 7.3 High severity
SICK SIM2x00 (ARM): Missing Authentication for Critical Functionality
Password recovery vulnerability in SICK SIM2x00 (ARM) Partnumber 1092673 and 1081902 with firmware version < 1.2.0 allows an unprivileged remote attacker to gain access to the userlevel defined as RecoverableUserLevel by invocating the password recovery mechan
- 9.8 Critical severity
SICK SIM1004: Missing Authentication for Critical Functionality
Password recovery vulnerability in SICK SIM1004 Partnumber 1098148 with firmware version <2.0.0 allows an unprivileged remote attacker to gain access to the userlevel defined as RecoverableUserLevel by invocating the password recovery mechanism method. This le
- 9.8 Critical severity
SICK SIM1000 FX: Missing Authentication for Critical Functionality
Password recovery vulnerability in SICK SIM1000 FX Partnumber 1097816 and 1097817 with firmware version <1.6.0 allows an unprivileged remote attacker to gain access to the userlevel defined as RecoverableUserLevel by invocating the password recovery mechanism
- 9.8 Critical severity
SICK SIM2000ST (PPC): Missing Authentication for Critical Functionality
Password recovery vulnerability in SICK SIM2000ST Partnumber 1080579 allows an unprivileged remote attacker to gain access to the userlevel defined as RecoverableUserLevel by invocating the password recovery mechanism method. This leads to an increase in their
- 9.8 Critical severity
SICK SIM4000 (PPC): Missing Authentication for Critical Functionality
Password recovery vulnerability in SICK SIM4000 (PPC) Partnumber 1078787 allows an unprivileged remote attacker to gain access to the userlevel defined as RecoverableUserLevel by invocating the password recovery mechanism method. This leads to an increase in t
- 9.1 Critical severity
SICK FlexiCompact: Improper Authorization
A remote unprivileged attacker can interact with the configuration interface of a Flexi-Compact FLX3-CPUC1 or FLX3-CPUC2 running an affected firmware version to potentially impact the availability of the FlexiCompact.
- 7.8 High severity
SICK Safety Designer: Deserialization of Untrusted Data
A deserialization vulnerability in a .NET framework class used and not properly checked by Safety Designer all versions up to and including 1.11.0 allows an attacker to craft malicious project files. Opening/importing such a malicious project file would execut