Sick vulnerabilities | LiveThreat CVE Feed

CVE	Product	CVSS	EPSS	Published	Summary
CVE-2026-1627	MF Mrs1000 Firmware Sick	8.1	0%	Feb 27	An attacker may exploit the use of outdated and weak MAC algorithms in the device’s SSH service to potentially compromise the integrity of the SSH session, allowing manipulation…
CVE-2026-1626	LF Lms1000 Firmware Sick	9.1	0%	Feb 27	An attacker may exploit the use of weak CBC-based cipher suites in the device’s SSH service to potentially observe or manipulate parts of the encrypted SSH communication, if they…
CVE-2026-22646	IG Incoming Goods Suite Sick	7.5	0%	Jan 15	Certain error messages returned by the application expose internal system details that should not be visible to end users, providing attackers with valuable reconnaissance…
CVE-2026-22645	IG Incoming Goods Suite Sick	5.3	0%	Jan 15	The application discloses all used components, versions and license information to unauthenticated actors, giving attackers the opportunity to target known security…
CVE-2026-22644	IG Incoming Goods Suite Sick	7.5	1%	Jan 15	Certain requests pass the authentication token in the URL as string query parameter, making it vulnerable to theft through server logs, proxy logs and Referer headers, which could…
CVE-2026-22919	TF Tdc-x401gl Firmware Sick	4.8	0%	Jan 15	An attacker with administrative access may inject malicious content into the login page, potentially enabling cross-site scripting (XSS) attacks, leading to the extraction of…
CVE-2026-22918	TF Tdc-x401gl Firmware Sick	8.2	0%	Jan 15	An attacker may exploit missing protection against clickjacking by tricking users into performing unintended actions through maliciously crafted web pages, leading to the…
CVE-2026-22917	TF Tdc-x401gl Firmware Sick	7.5	1%	Jan 15	Improper input handling in a system endpoint may allow attackers to overload resources, causing a denial of service
CVE-2026-22916	TF Tdc-x401gl Firmware Sick	5.4	0%	Jan 15	An attacker with low privileges may be able to trigger critical system functions such as reboot or factory reset without proper restrictions, potentially leading to service…
CVE-2026-22915	TF Tdc-x401gl Firmware Sick	6.5	0%	Jan 15	An attacker with low privileges may be able to read files from specific directories on the device, potentially exposing sensitive information
CVE-2026-22914	TF Tdc-x401gl Firmware Sick	6.5	0%	Jan 15	An attacker with limited permissions may still be able to write files to specific locations on the device, potentially leading to system manipulation
CVE-2026-22913	TF Tdc-x401gl Firmware Sick	6.1	0%	Jan 15	Improper handling of a URL parameter may allow attackers to execute code in a user's browser after login
CVE-2026-22912	TF Tdc-x401gl Firmware Sick	6.1	0%	Jan 15	Improper validation of a login parameter may allow attackers to redirect users to malicious websites after authentication
CVE-2026-22911	TF Tdc-x401gl Firmware Sick	7.5	1%	Jan 15	Firmware update files may expose password hashes for system accounts, which could allow a remote attacker to recover credentials and gain unauthorized access to the device
CVE-2026-22910	TF Tdc-x401gl Firmware Sick	9.1	0%	Jan 15	The device is deployed with weak and publicly known default passwords for certain hidden user levels, increasing the risk of unauthorized access
CVE-2026-22909	TF Tdc-x401gl Firmware Sick	9.1	1%	Jan 15	Certain system functions may be accessed without proper authorization, allowing attackers to start, stop, or delete installed applications, potentially disrupting system…
CVE-2026-22908	TF Tdc-x401gl Firmware Sick	9.1	1%	Jan 15	Uploading unvalidated container images may allow remote attackers to gain full access to the system, potentially compromising its integrity and confidentiality
CVE-2026-22907	TF Tdc-x401gl Firmware Sick	9.1	0%	Jan 15	An attacker may gain unauthorized access to the host filesystem, potentially allowing them to read and modify system data
CVE-2025-59463	TF Tloc100-100 Firmware Sick	7.5	0%	Oct 27	An attacker may cause chunk-size mismatches that block file transfers and prevent subsequent transfers
CVE-2025-59462	TF Tloc100-100 Firmware Sick	7.5	1%	Oct 27	An attacker who tampers with the C++ CLI client may crash the UpdateService during file transfers, disrupting updates and availability
CVE-2025-59461	TF Tloc100-100 Firmware Sick	9.8	0%	Oct 27	A remote unauthenticated attacker may use the unauthenticated C++ API to access or modify sensitive data and disrupt services
CVE-2025-59460	TF Tloc100-100 Firmware Sick	7.5	0%	Oct 27	The system is deployed in its default state, with configuration settings that do not comply with the latest best practices for restricting access
CVE-2025-59459	TF Tloc100-100 Firmware Sick	7.5	0%	Oct 27	An attacker that gains SSH access to an unprivileged account may be able to disrupt services (including SSH), causing persistent loss of availability
CVE-2025-9914	LD Logistic Diagnostic Analytics Sick	7.5	0%	Oct 6	The credentials of the users stored in the system's local database can be used for the log in, making it possible for an attacker to gain unauthorized access
CVE-2025-9913	TA Tire Analytics Sick	6.1	0%	Oct 6	JavaScript can be ran inside the address bar via the dashboard "Open in new Tab" Button, making the application vulnerable to session hijacking
CVE-2025-58591	BA Baggage Analytics Sick	7.5	1%	Oct 6	A remote, unauthorized attacker can brute force folders and files and read them like private keys or configurations, making the application vulnerable for gathering sensitive…
CVE-2025-58590	TA Tire Analytics Sick	7.5	1%	Oct 6	It's possible to brute force folders and files, what can be used by an attacker to steal sensitve information
CVE-2025-58589	LD Logistic Diagnostic Analytics Sick	6.5	0%	Oct 6	When an error occurs in the application a full stacktrace is provided to the user
CVE-2025-58587	TA Tire Analytics Sick	9.8	0%	Oct 6	The application does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame, making it possible for an attacker to guess…
CVE-2025-58586	EA Enterprise Analytics Sick	5.3	0%	Oct 6	For failed login attempts, the application returns different error messages depending on whether the login failed due to an incorrect password or a non-existing username
CVE-2025-58585	BA Baggage Analytics Sick	7.5	0%	Oct 6	Multiple endpoints with sensitive information do not require authentication, making the application susceptible to information gathering
CVE-2025-58584	LD Logistic Diagnostic Analytics Sick	7.5	0%	Oct 6	In the HTTP request, the username and password are transferred directly in the URL as parameters
CVE-2025-58583	EA Enterprise Analytics Sick	5.3	0%	Oct 6	The application provides access to a login protected H2 database for caching purposes
CVE-2025-58582	EA Enterprise Analytics Sick	7.5	1%	Oct 6	If a user tries to login but the provided credentials are incorrect a log is created
CVE-2025-58581	EA Enterprise Analytics Sick	4.3	0%	Oct 6	When an error occurs in the application a full stacktrace is provided to the user
CVE-2025-58580	EA Enterprise Analytics Sick	5.3	0%	Oct 6	An API endpoint allows arbitrary log entries to be created via POST request
CVE-2025-58579	BA Baggage Analytics Sick	5.3	0%	Oct 6	Due to a lack of authentication, it is possible for an unauthenticated user to request data from this endpoint, making the application vulnerable for user enumeration
CVE-2025-58578	EA Enterprise Analytics Sick	4.3	0%	Oct 6	A user with the appropriate authorization can create any number of user accounts via an API endpoint using a POST request
CVE-2025-49200	FA Field Analytics Sick	7.5	0%	Jun 12	The created backup files are unencrypted, making the application vulnerable for gathering sensitive information by downloading and decompressing the backup files
CVE-2025-49199	FA Field Analytics Sick	9.8	0%	Jun 12	The backup ZIPs are not signed by the application, leading to the possibility that an attacker can download a backup ZIP, modify and re-upload it
CVE-2025-49198	MS Media Server Sick	7.5	0%	Jun 12	The Media Server’s authorization tokens have a poor quality of randomness
CVE-2025-49197	MS Media Server Sick	7.5	0%	Jun 12	The application uses a weak password hash function, allowing an attacker to crack the weak password hash to gain access to an FTP user account
CVE-2025-49196	FA Field Analytics Sick	9.1	0%	Jun 12	A service supports the use of a deprecated and unsafe TLS version
CVE-2025-49195	MS Media Server Sick	9.8	1%	Jun 12	The FTP server’s login mechanism does not restrict authentication attempts, allowing an attacker to brute-force user passwords and potentially compromising the FTP server
CVE-2025-49194	MS Media Server Sick	7.5	0%	Jun 12	The server supports authentication methods in which credentials are sent in plaintext over unencrypted channels
CVE-2025-49193	BA Baggage Analytics Sick	6.1	0%	Jun 12	The application fails to implement several security headers
CVE-2025-49192	FA Field Analytics Sick	6.1	0%	Jun 12	The web application is vulnerable to clickjacking attacks
CVE-2025-49191	FA Field Analytics Sick	6.1	0%	Jun 12	Linked URLs during the creation of iFrame widgets and dashboards are vulnerable to code execution
CVE-2025-49190	FA Field Analytics Sick	5.8	0%	Jun 12	The application is vulnerable to Server-Side Request Forgery (SSRF)
CVE-2025-49189	MS Media Server Sick	6.1	0%	Jun 12	The HttpOnlyflag of the session cookie \"@@\" is set to false
CVE-2025-49188	FA Field Analytics Sick	7.5	0%	Jun 12	The application sends user credentials as URL parameters instead of POST bodies, making it vulnerable to information gathering
CVE-2025-49187	FA Field Analytics Sick	5.3	0%	Jun 12	For failed login attempts, the application returns different error messages depending on whether the login failed due to an incorrect password or a non-existing username
CVE-2025-49186	BA Baggage Analytics Sick	6.5	0%	Jun 12	The product does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame, making it susceptible to brute-force attacks
CVE-2025-49185	FA Field Analytics Sick	5.4	0%	Jun 12	The web application is susceptible to cross-site-scripting attacks
CVE-2025-49184	LD Logistic Diagnostic Analytics Sick	7.5	0%	Jun 12	A remote unauthorized attacker may gather sensitive information of the application, due to missing authorization of configuration settings of the product
CVE-2025-49183	MS Media Server Sick	7.5	0%	Jun 12	All communication with the REST API is unencrypted (HTTP), allowing an attacker to intercept traffic between an actor and the webserver
CVE-2025-49182	MS Media Server Sick	9.8	1%	Jun 12	Files in the source code contain login credentials for the admin user and the property configuration password, allowing an attacker to get full access to the application
CVE-2025-49181	MS Media Server Sick	8.6	0%	Jun 12	Due to missing authorization of an API endpoint, unauthorized users can send HTTP GET requests to gather sensitive information
CVE-2023-5246	FF Fx0-gent00000 Firmware Sick	8.8	1%	Oct 23	Authentication Bypass by Capture-replay in SICK Flexi Soft Gateways with Partnumbers 1044073, 1127717, 1130282, 1044074, 1121597, 1099832, 1051432, 1127487, 1069070, 1112296,…
CVE-2023-5103	AF Apu0200 Firmware Sick	4.3	1%	Oct 9	Improper Restriction of Rendered UI Layers or Frames in RDT400 in SICK APU allows an unprivileged remote attacker to potentially reveal sensitive information via tricking a user…