Vulnerability in Sick Lms1000
CVE-2026-1626
An attacker may exploit the use of weak CBC-based cipher suites in the device’s SSH service to potentially observe or manipulate parts of the encrypted SSH communication, if they are able to intercept or interact with the network traffic.
Vulnerability class: POODLE (CVE-2014-3566)
EPSS: 0.002 (10.0th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 6.5 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N.
Affected products
- Sick Lms1000
- Sick Lms1000_firmware
- Sick Mrs1000
- Sick Mrs1000_firmware
- Sick Ag Lms1000 — versions 0
- Sick Ag Mrs1000 — versions 0
Weakness classification (CWE)
References
- psirt@sick.de (x_SICK PSIRT Security Advisories, Vendor Advisory)
- psirt@sick.de (Vendor Advisory, x_SICK Operating Guidelines)
- psirt@sick.de (US Government Resource, x_ICS-CERT recommended practices on Industrial Security)
- psirt@sick.de (x_CVSS v3.1 Calculator, Not Applicable)
- psirt@sick.de (x_The canonical URL., Vendor Advisory)
- psirt@sick.de (vendor-advisory, Vendor Advisory)
Frequently asked questions
- What is CVE-2026-1626?
- CVE-2026-1626 is a medium-severity vulnerability in Sick Lms1000, classified under Use of a Broken or Risky Cryptographic Algorithm. CVSS score: 6.5/10. Published 2026-02-27.
- How severe is CVE-2026-1626?
- Medium severity. CVSS v3 base score is 6.5 out of 10.