CVE-2026-11841 Overview
CVE-2026-11841 is a critical access control vulnerability in the AppEngine File Access over HTTP feature. The flaw exposes a sensitive filesystem directory without authentication, allowing remote attackers to read and write protected files. Affected files include device parameter files that store customer-defined passwords and application configuration data. Attackers can also reach the custom application directory, enabling execution of arbitrary Lua code inside the sandboxed AppEngine runtime. The issue is tracked under [CWE-552] (Files or Directories Accessible to External Parties) and is documented in the SICK CSAF advisory sca-2026-0010.
Critical Impact
Remote unauthenticated attackers can modify device passwords, alter application parameters, and execute arbitrary Lua code within the AppEngine sandbox.
Affected Products
- SICK devices running the affected AppEngine firmware exposing HTTP file access
- Products enumerated in the SICK CSAF JSON advisory
- Deployments with the AppEngine File Access over HTTP feature enabled
Discovery Timeline
- 2026-07-28 - CVE-2026-11841 published to NVD
- 2026-07-28 - Last updated in NVD database
Technical Details for CVE-2026-11841
Vulnerability Analysis
The AppEngine File Access feature serves files over HTTP but fails to restrict access to sensitive filesystem directories. A critical internal directory was unintentionally exposed through this interface, and requests reach it without authentication. Attackers reach device parameter files that hold operational settings and customer-configured passwords. Because writes are also permitted, adversaries can replace credentials, tamper with configuration, or drop Lua scripts into the custom application directory. Any Lua code placed there executes within the sandboxed AppEngine environment, giving attackers a foothold inside application logic on the device. The vulnerability is exploitable over the network with low complexity and no user interaction.
Root Cause
The root cause is improper access restriction on HTTP endpoints exposed by the AppEngine file access handler. The handler resolves paths into directories that should have been reserved for privileged internal use. Neither authentication nor path scoping is enforced before serving or writing those files, mapping directly to [CWE-552].
Attack Vector
Exploitation requires network reachability to the device HTTP interface. An attacker issues HTTP requests targeting the exposed directory paths, downloads parameter files to harvest passwords, and uploads modified files or Lua scripts. No credentials or user interaction are required. See the SICK PSIRT advisory portal for vendor-confirmed exploitation prerequisites.
No verified public exploit code is available. Technical details are described in prose in accordance with the SICK CSAF advisory.
Detection Methods for CVE-2026-11841
Indicators of Compromise
- Unexpected HTTP GET or PUT requests to AppEngine file access endpoints from external or non-administrative sources
- Modifications to device parameter files or password fields outside of scheduled maintenance windows
- New or altered Lua scripts in the custom application directory that were not deployed by operators
- Authentication failures or configuration changes on the device following anonymous HTTP activity
Detection Strategies
- Inspect device HTTP access logs for requests targeting file access URIs originating from unauthorized IP ranges
- Baseline the contents and hashes of parameter files and Lua application files, then alert on drift
- Correlate network flow data with device configuration changes to identify unauthenticated write operations
Monitoring Recommendations
- Forward device HTTP and audit logs to a centralized SIEM for continuous review
- Monitor for anomalous outbound behavior from AppEngine hosts that could indicate malicious Lua execution
- Alert on any HTTP traffic to the AppEngine file access interface sourced from outside the operational network segment
How to Mitigate CVE-2026-11841
Immediate Actions Required
- Restrict network access to the device HTTP interface to trusted management hosts only
- Disable the AppEngine File Access over HTTP feature where operationally feasible
- Rotate all customer-defined passwords stored on affected devices after applying controls
- Audit parameter files and the custom application directory for unauthorized modifications
Patch Information
Refer to the SICK CSAF advisory sca-2026-0010 and the SICK PSIRT portal for firmware versions containing the fix and vendor-supplied remediation steps. Apply vendor-recommended firmware updates as soon as they are validated in your environment.
Workarounds
- Segment devices onto isolated OT networks following CISA ICS Recommended Practices
- Place the device behind a firewall or VPN, blocking direct HTTP exposure to untrusted networks
- Apply the hardening guidance in the SICK Cybersecurity Operating Guidelines
- Monitor and log all administrative access to the device until patched firmware is deployed
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
