EUVD-2026-49732
GHSA-5x3h-wq76-mxqx
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L
Unauthenticated network access to file read/write gives high confidentiality and integrity impact, with limited availability disruption.
Primary rating from Vendor (sick).
CVSS VectorVendor: sick
Lifecycle Timeline
3DescriptionCVE.org
An attacker may perform unauthenticated read and write operations on sensitive filesystem areas via the AppEngine Fileaccess over HTTP due to improper access restrictions. A critical filesystem directory was unintentionally exposed through the HTTP-based file access feature, allowing access without authentication. This includes device parameter files, enabling an attacker to read and modify application settings, including customer-defined passwords. Additionally, exposure of the custom application directory may allow execution of arbitrary Lua code within the sandboxed AppEngine environment.
AnalysisAI
Unauthenticated read and write access to sensitive filesystem areas in SICK AppEngine's file access feature allows remote attackers to extract customer-defined passwords, modify application settings, and execute arbitrary Lua code within the sandboxed environment. The vulnerability stems from improper access restrictions on an HTTP-based file access endpoint, which exposes a critical directory without requiring credentials. At the time of analysis, no public exploit or active exploitation (KEV) has been confirmed, but the CVSS 9.4 score reflects the ease of exploitation and high impact.
Technical ContextAI
The vulnerability resides in the HTTP-based file access component of the SICK AppEngine, an edge computing runtime likely used in industrial IoT devices. The feature exposes filesystem directories over an HTTP endpoint, and due to missing access controls (CWE-552: Files or Directories Accessible to External Parties), any remote party can read and write files. This includes device parameter files and custom application Lua scripts, which are executed within a sandbox. The root cause is an unintentional directory exposure, not a traversal flaw per se, though the attacker can subsequently navigate to sensitive areas.
RemediationAI
Apply the vendor-supplied patch or follow the mitigation guidance in SICK security advisory SCA-2026-0010. The advisory is available at https://www.sick.com/.well-known/csaf/white/2026/sca-2026-0010.pdf. If patching is not immediately possible, restrict network access to the AppEngine management interface (or specifically the file access endpoint) using firewall rules, disable the HTTP file access feature if the deployment allows, or place the device behind a VPN. Disabling the feature may disrupt remote configuration or application management, so verify operational impact.
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today