SCA-2026-0003
Vulnerability from csaf_sick - Published: 2026-01-26 14:00 - Updated: 2026-01-26 14:00Summary
Vulnerability affecting SICK nanoScan3 and microScan3
Notes
summary
SICK has identified a 3rd party vulnerability (CVE-2025-55093) in the nanoScan3 and microScan3. Only specific variants within the microScan3 and nanoScan3 families are affected by CVE-2025-55093. The underlying issue in the NetX Duo networking module could, under specific conditions, cause the device to enter a safe error state that requires a restart. SICK recommends applying the mitigation for CVE-2025-55093.
General Security Measures
As general security measures, SICK recommends to minimize network exposure of the devices, restrict network access and follow recommended security practices in order to run the devices in a protected IT environment.
Vulnerability Classification
SICK performs vulnerability classification by using the CVSS scoring system (*CVSS v3.1*). The environmental score is dependent on the customer’s environment and can affect the overall CVSS score. SICK recommends that customers individually evaluate the environmental score to achieve final scoring.
{
"document": {
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en-US",
"notes": [
{
"category": "summary",
"text": "SICK has identified a 3rd party vulnerability (CVE-2025-55093) in the nanoScan3 and microScan3. Only specific variants within the microScan3 and nanoScan3 families are affected by CVE-2025-55093. The underlying issue in the NetX Duo networking module could, under specific conditions, cause the device to enter a safe error state that requires a restart. SICK recommends applying the mitigation for CVE-2025-55093.",
"title": "summary"
},
{
"category": "general",
"text": "As general security measures, SICK recommends to minimize network exposure of the devices, restrict network access and follow recommended security practices in order to run the devices in a protected IT environment.",
"title": "General Security Measures"
},
{
"category": "general",
"text": "SICK performs vulnerability classification by using the CVSS scoring system (*CVSS v3.1*). The environmental score is dependent on the customer\u2019s environment and can affect the overall CVSS score. SICK recommends that customers individually evaluate the environmental score to achieve final scoring.",
"title": "Vulnerability Classification"
}
],
"publisher": {
"category": "vendor",
"contact_details": "psirt@sick.de",
"issuing_authority": "SICK AG issues and issues in EHS products (when related to the Endress+Hauser SICK (EHS) joint venture).",
"name": "SICK PSIRT",
"namespace": "https://www.sick.com/psirt"
},
"references": [
{
"summary": "SICK PSIRT Security Advisories",
"url": "https://sick.com/psirt"
},
{
"summary": "SICK Operating Guidelines",
"url": "https://www.sick.com/media/docs/9/19/719/special_information_sick_operating_guidelines_cybersecurity_by_sick_en_im0106719.pdf"
},
{
"summary": "ICS-CERT recommended practices on Industrial Security",
"url": "https://www.cisa.gov/resources-tools/resources/ics-recommended-practices"
},
{
"summary": "CVSS v3.1 Calculator",
"url": "https://www.first.org/cvss/calculator/3.1"
},
{
"category": "self",
"summary": "The canonical URL.",
"url": "https://www.sick.com/.well-known/csaf/white/2026/sca-2026-0003.json"
}
],
"title": "Vulnerability affecting SICK nanoScan3 and microScan3",
"tracking": {
"current_release_date": "2026-01-26T14:00:00.000Z",
"generator": {
"date": "2026-01-19T11:53:15.309Z",
"engine": {
"name": "Secvisogram",
"version": "2.5.42"
}
},
"id": "SCA-2026-0003",
"initial_release_date": "2026-01-26T14:00:00.000Z",
"revision_history": [
{
"date": "2026-01-26T14:00:00.000Z",
"number": "1",
"summary": "Initial version"
}
],
"status": "final",
"version": "1"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SICK microScan3 Pro I/O all versions",
"product_id": "CSAFPID-0002",
"product_identification_helper": {
"skus": [
"1133817",
"1133819",
"1133821"
]
}
}
}
],
"category": "product_name",
"name": "microScan3 Pro I/O "
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SICK microScan3 EtherCAT all versions",
"product_id": "CSAFPID-0003",
"product_identification_helper": {
"skus": [
"1108231",
"1108233",
"1108235",
"1108227",
"1104317",
"1108229",
"1138061",
"1138063",
"1138065"
]
}
}
}
],
"category": "product_name",
"name": "microScan3 EtherCAT"
}
],
"category": "product_family",
"name": "microScan3"
},
{
"branches": [
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SICK nanoScan3 Core I/O all versions",
"product_id": "CSAFPID-0005",
"product_identification_helper": {
"skus": [
"1100333"
]
}
}
}
],
"category": "product_name",
"name": "nanoScan3 Core I/O"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SICK nanoScan3 Pro I/O all versions",
"product_id": "CSAFPID-0006",
"product_identification_helper": {
"skus": [
"1100334",
"1137779",
"1137780"
]
}
}
}
],
"category": "product_name",
"name": "nanoScan3 Pro I/O"
}
],
"category": "product_family",
"name": "nanoScan3"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SICK microScan3 Pro I/O Firmware all versions",
"product_id": "CSAFPID-0009"
}
}
],
"category": "product_name",
"name": "microScan3 Pro I/O Firmware"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SICK microScan3 EtherCAT Firmware all versions",
"product_id": "CSAFPID-0010"
}
}
],
"category": "product_name",
"name": "microScan3 EtherCAT Firmware"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SICK nanoScan3 Core I/O Firmware all versions",
"product_id": "CSAFPID-0011"
}
}
],
"category": "product_name",
"name": "nanoScan3 Core I/O Firmware"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SICK nanoScan3 Pro I/O Firmware all versions",
"product_id": "CSAFPID-0012"
}
}
],
"category": "product_name",
"name": "nanoScan3 Pro I/O Firmware"
}
],
"category": "vendor",
"name": "SICK AG"
}
],
"relationships": [
{
"category": "installed_on",
"full_product_name": {
"name": "SICK microScan3 Pro I/O all Firmware versions",
"product_id": "CSAFPID-0015"
},
"product_reference": "CSAFPID-0009",
"relates_to_product_reference": "CSAFPID-0002"
},
{
"category": "installed_on",
"full_product_name": {
"name": "SICK microScan3 EtherCAT all Firmware versions",
"product_id": "CSAFPID-0016"
},
"product_reference": "CSAFPID-0010",
"relates_to_product_reference": "CSAFPID-0003"
},
{
"category": "installed_on",
"full_product_name": {
"name": "SICK nanoScan3 Core I/O all Firmware versions",
"product_id": "CSAFPID-0017"
},
"product_reference": "CSAFPID-0011",
"relates_to_product_reference": "CSAFPID-0005"
},
{
"category": "installed_on",
"full_product_name": {
"name": "SICK nanoScan3 Pro I/O all Firmware versions",
"product_id": "CSAFPID-0018"
},
"product_reference": "CSAFPID-0012",
"relates_to_product_reference": "CSAFPID-0006"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2025-55093",
"cwe": {
"id": "CWE-125",
"name": "Out-of-bounds Read"
},
"notes": [
{
"category": "summary",
"text": "In NetX Duo before 6.4.4, the networking support module for Eclipse Foundation ThreadX, there was a potential out of bound read issue in _nx_ipv4_packet_receive() when handling unicast DHCP messages that could cause corruption of 4 bytes of memory.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0015",
"CSAFPID-0016",
"CSAFPID-0017",
"CSAFPID-0018"
]
},
"remediations": [
{
"category": "mitigation",
"details": "Ensure that an IP address is configured or assigned via DHCP and that the network is properly secured against unauthorized access so that only trusted entities have access to the devices. Furthermore, you should apply the following General Security Measures when operating the product to mitigate the associated security risk. The collected resources \u201dSICK Operating Guidelines\u201d and \u201dICS-CERT recommended practices on Industrial Security\u201d could help to implement the general security practices.\n",
"product_ids": [
"CSAFPID-0015",
"CSAFPID-0016",
"CSAFPID-0017",
"CSAFPID-0018"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"environmentalScore": 5.3,
"environmentalSeverity": "MEDIUM",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"temporalScore": 5.3,
"temporalSeverity": "MEDIUM",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-0015",
"CSAFPID-0016",
"CSAFPID-0017",
"CSAFPID-0018"
]
}
],
"title": "CVE-2025-55093"
}
]
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…