CVE-2026-22645
📋 TL;DR
This vulnerability allows unauthenticated attackers to view detailed information about all software components, versions, and licenses used by the application. This information disclosure enables attackers to identify and target known security vulnerabilities in those components. Any system running the affected application with default configurations is vulnerable.
💻 Affected Systems
- SICK industrial automation products and software
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Attackers use disclosed component information to identify and exploit known vulnerabilities in those components, potentially leading to full system compromise, data theft, or ransomware deployment.
Likely Case
Attackers map the attack surface by identifying vulnerable components, then launch targeted attacks against known vulnerabilities in outdated libraries or frameworks.
If Mitigated
With proper network segmentation and access controls, attackers cannot reach the information disclosure endpoint, limiting reconnaissance opportunities.
🎯 Exploit Status
Exploitation requires only HTTP requests to access information disclosure endpoints; no authentication needed
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Consult vendor advisory for specific patched versions
Vendor Advisory: https://www.sick.com/.well-known/csaf/white/2026/sca-2026-0002.json
Restart Required: Yes
Instructions:
1. Review vendor advisory SCA-2026-0002. 2. Identify affected products and versions. 3. Apply vendor-provided patches or firmware updates. 4. Restart affected systems. 5. Verify patch application.
🔧 Temporary Workarounds
Network Access Restriction
allRestrict network access to affected systems using firewalls or network segmentation
Authentication Enforcement
allImplement authentication requirements for information disclosure endpoints
🧯 If You Can't Patch
- Implement strict network segmentation to isolate affected systems from untrusted networks
- Deploy web application firewalls to block requests to information disclosure endpoints
🔍 How to Verify
Check if Vulnerable:
Send HTTP requests to application endpoints that may disclose component information; check if version/license details are returned without authenticationCheck Version:
Consult vendor documentation for version checking commands specific to each productVerify Fix Applied:
After patching, verify that component information is no longer disclosed to unauthenticated requests📡 Detection & Monitoring
Log Indicators:
- Multiple unauthenticated requests to component information endpoints
- Unusual scanning patterns from external IPs
Network Indicators:
- HTTP requests to paths containing version, license, or component information
- Reconnaissance traffic patterns
SIEM Query:
source_ip=external AND (http_path CONTAINS 'version' OR http_path CONTAINS 'license' OR http_path CONTAINS 'component') AND auth_status='failed'🔗 References
- https://sick.com/psirt
- https://www.cisa.gov/resources-tools/resources/ics-recommended-practices
- https://www.first.org/cvss/calculator/3.1
- https://www.sick.com/.well-known/csaf/white/2026/sca-2026-0002.json
- https://www.sick.com/.well-known/csaf/white/2026/sca-2026-0002.pdf
- https://www.sick.com/media/docs/9/19/719/special_information_sick_operating_guidelines_cybersecurity_by_sick_en_im0106719.pdf
