Description
An attacker may achieve arbitrary code execution on a target system by uploading a malicious device driver package, bypassing driver verification mechanisms, and triggering the execution of attacker-controlled code. User interaction is required.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
SICK AG Sentio Creator Extension 'Device Manager'
Default version status: affected
0 to ≤ 1.4affected
References
- https://www.sick.com/psirt ↗
- https://www.sick.com/media/docs/9/19/719/special_information_sick_operating_guidelines_cybersecurity_by_sick_en_im0106719.pdf ↗
- https://www.cisa.gov/resources-tools/resources/ics-recommended-practices ↗
- https://www.first.org/cvss/calculator/3.1 ↗
- https://www.sick.com/.well-known/csaf/white/2026/sca-2026-0012.json ↗
- https://www.sick.com/.well-known/csaf/white/2026/sca-2026-0012.pdf ↗