Information disclosure in Sick Incoming_goods_suite
CVE-2026-22646
Certain error messages returned by the application expose internal system details that should not be visible to end users, providing attackers with valuable reconnaissance information (like file paths, database errors, or software versions…
EPSS: 0.004 (28.9th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 4.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N.
Affected products
Weakness classification (CWE)
References
- psirt@sick.de (x_SICK PSIRT Security Advisories, Vendor Advisory)
- psirt@sick.de (x_SICK Operating Guidelines, Product)
- psirt@sick.de (US Government Resource, x_ICS-CERT recommended practices on Industrial Security)
- psirt@sick.de (x_CVSS v3.1 Calculator, Not Applicable)
- psirt@sick.de (x_The canonical URL., Vendor Advisory)
- psirt@sick.de (vendor-advisory, Vendor Advisory)
Frequently asked questions
- What is CVE-2026-22646?
- CVE-2026-22646 is a medium-severity vulnerability in Sick Incoming_goods_suite, classified under Generation of Error Message Containing Sensitive Information. CVSS score: 4.3/10. Published 2026-01-15.
- How severe is CVE-2026-22646?
- Medium severity. CVSS v3 base score is 4.3 out of 10.