CVE-2026-101290

7.5High

Published 15 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash

7.5High

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None
Impact: High impact on availability
Weakness: CWE-125

Impact

Unauthenticated network attackers can crash the affected SICK service and trigger a denial of service. They only need network access to send a single malformed packet.

Root cause

The application fails to validate incoming packet lengths, triggering an out-of-bounds memory read that crashes the process.

Affected systems

Versions not listed — check the vendor advisory.

CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Fix & remediation

Check SICK security advisory sca-2026-0015 for the patched firmware or software version; restrict network access to the affected devices at the firewall to trusted hosts while waiting to patch.

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

A remote attacker may send a specially crafted network packet that causes the affected application to perform an out-of-bounds memory read due to insufficient validation of packet length. This may result in an application crash and a denial-of-service condition.

References

Source: nvd.nist.gov/vuln/detail/CVE-2026-101290