{ "document": { "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en-US", "notes": [ { "category": "summary", "text": "SICK identified multiple products affected by the Brotli vulnerability, also known as Broccoli2Shell (CVE-2026-111497). Successful exploitation of this vulnerability could impact the confidentiality, integrity, and availability of affected systems. At the time of publication, SICK is not aware of any active exploitation of this vulnerability targeting SICK products. SICK strongly recommends that customers review and implement the remediation measures provided in this advisory to reduce potential security risks.", "title": "Summary" }, { "category": "description", "text": "If exploited, the vulnerability could potentially allow an unauthenticated attacker to compromise the availability, integrity, and confidentiality of the product.", "title": "Impact" }, { "category": "description", "text": "As general security measures, SICK recommends minimizing network exposure of the devices, restricting network access, and following recommended security practices in order to operate the devices in a protected IT environment.", "title": "Mitigation" }, { "category": "description", "text": "SICK recommends updating the product to the fixed version and ensuring that the product operates within a secure environment.", "title": "Remediation" }, { "category": "general", "text": "As general security measures, SICK recommends minimizing network exposure of the devices, restricting network access and following recommended security practices in order to run the devices in a protected IT environment.", "title": "General Security Measures" }, { "category": "general", "text": "SICK performs vulnerability classification by using the CVSS scoring system (*CVSS v3.1*). The environmental score is dependent on the customer’s environment and can affect the overall CVSS score. SICK recommends that customers individually evaluate the environmental score to achieve final scoring.", "title": "Vulnerability Classification" } ], "publisher": { "category": "vendor", "contact_details": "psirt@sick.de", "issuing_authority": "SICK AG issues and issues in EHS products (when related to the Endress+Hauser SICK (EHS) joint venture).", "name": "SICK PSIRT", "namespace": "https://www.sick.com/psirt" }, "references": [ { "summary": "SICK PSIRT Security Advisories", "url": "https://www.sick.com/psirt" }, { "summary": "SICK Operating Guidelines", "url": "https://www.sick.com/media/docs/9/19/719/special_information_sick_operating_guidelines_cybersecurity_by_sick_en_im0106719.pdf" }, { "summary": "ICS-CERT recommended practices on Industrial Security", "url": "https://www.cisa.gov/resources-tools/resources/ics-recommended-practices" }, { "summary": "CVSS v3.1 Calculator", "url": "https://www.first.org/cvss/calculator/3.1" }, { "category": "self", "summary": "The canonical URL.", "url": "https://www.sick.com/.well-known/csaf/white/2026/sca-2026-0017.json" } ], "title": "SICK Products affected by Brotli Vulnerability (Broccoli2Shell)", "tracking": { "current_release_date": "2026-11-06T09:59:00.000Z", "generator": { "date": "2026-10-30T09:33:12.182Z", "engine": { "name": "Secvisogram", "version": "2.6.16" } }, "id": "sca-2026-0017", "initial_release_date": "2026-11-06T09:59:00.000Z", "revision_history": [ { "date": "2026-11-06T09:59:00.000Z", "number": "1", "summary": "Initial version" } ], "status": "final", "version": "1" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "branches": [ { "category": "product_version_range", "name": "< 2026.1.3", "product": { "name": "SICK CorivaHub < 2026.1.3", "product_id": "CSAFPID-51000" } }, { "category": "product_version", "name": "2026.1.3", "product": { "name": "SICK CorivaHub 2026.1.3", "product_id": "CSAFPID-52000" } } ], "category": "product_name", "name": "CorivaHub" } ], "category": "product_family", "name": "Localization systems" }, { "branches": [ { "branches": [ { "category": "product_version_range", "name": "vers:all/*", "product": { "name": "SICK Logistics Diagnostic Analytics all versions", "product_id": "CSAFPID-51001" } } ], "category": "product_name", "name": "Logistics Diagnostic Analytics" }, { "branches": [ { "category": "product_version_range", "name": "vers:all/*", "product": { "name": "SICK Package Analytics all versions", "product_id": "CSAFPID-51002" } } ], "category": "product_name", "name": "Package Analytics" }, { "branches": [ { "category": "product_version_range", "name": "vers:all/*", "product": { "name": "SICK Baggage Analytics all versions", "product_id": "CSAFPID-51003" } } ], "category": "product_name", "name": "Baggage Analytics" }, { "branches": [ { "category": "product_version_range", "name": "vers:all/*", "product": { "name": "SICK Tire Analytics all versions", "product_id": "CSAFPID-51004" } } ], "category": "product_name", "name": "Tire Analytics" } ], "category": "product_family", "name": "Insight Tools" } ], "category": "vendor", "name": "SICK AG" } ] }, "vulnerabilities": [ { "cve": "CVE-2026-111497", "cwe": { "id": "CWE-252", "name": "Unchecked Return Value" }, "notes": [ { "audience": "all", "category": "summary", "text": "A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream. Users need to update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.0.10 or 1.1.1 or 1.2.1.", "title": "Summary" } ], "product_status": { "fixed": [ "CSAFPID-52000" ], "known_affected": [ "CSAFPID-51000", "CSAFPID-51001", "CSAFPID-51002", "CSAFPID-51003", "CSAFPID-51004" ], "recommended": [ "CSAFPID-52000" ] }, "remediations": [ { "category": "vendor_fix", "date": "2026-10-29T09:59:43.074Z", "details": "Users are recommended to re-install or upgrade to version 2026.1.3 while setting the global.imagePullPolicy to 'IfNotPresent'.", "product_ids": [ "CSAFPID-51000" ] }, { "category": "workaround", "date": "2026-10-29T09:59:43.074Z", "details": "As an immediate risk reduction measure, customers should disable the affected services on affected systems: 1.Open Windows Services. 2.Stop the following services (if present): •SICK Node-RED •SICK An Native Access •SICK An Bridge 3. Set the Startup Type for each service to Disabled. For most customers, disabling Node-RED is not expected to impact normal Process Analytics functionality, provided that Node-RED integrations are not being used to consume data from third-party systems.", "product_ids": [ "CSAFPID-51001", "CSAFPID-51002", "CSAFPID-51003", "CSAFPID-51004" ] }, { "category": "workaround", "details": "Customers may disable the offline map functionality by\nsetting corivaHubOfflineMap.enabled to false in the CorivaHub configuration. This prevents the affected MapLibre GL component from being loaded and mitigates the vulnerability. The workaround is not expected to have a significant impact on normal production operations. Detailed configuration instructions are available in the CorivaHub documentation: https://portal.coriva.io/portal/app/hubdocs?s=main%252F2026.1%252Fdeployment%252Fcluster%252Fconfig-values.html%2523_tile_server", "product_ids": [ "CSAFPID-51000" ] }, { "category": "vendor_fix", "details": "The provided fix addresses exploitation via Node-RED only. Exploitation via Bridge and native Access remains possible and must be mitigated using the documented workarounds. Customers who require Node-RED functionality may manually update the bundled Node.js runtime on each affected Process Analytics instance: 1. Stop the SICK Node-RED service. 2. Create a backup of the following directory: C:\\Program Files\\SICK\\Analytics Solutions\\node-red\\runtime\\nodejs 3. Download and extract Node.js 24.22.1. 4. Replace the existing nodejs directory with the extracted version. 5. Verify the installed version:node.exe -v 6. Restart the SICK Node-RED service. 7. Validate that Process Analytics and Node-RED functionality operate as expected. 8. If any issues are observed, restore the backup and revert to the previous version.", "product_ids": [ "CSAFPID-51001", "CSAFPID-51002", "CSAFPID-51003", "CSAFPID-51004" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "environmentalScore": 9.8, "environmentalSeverity": "CRITICAL", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "temporalScore": 9.8, "temporalSeverity": "CRITICAL", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "CSAFPID-51000", "CSAFPID-51001", "CSAFPID-51002", "CSAFPID-51003", "CSAFPID-51004" ] } ], "title": "CVE-2026-111497" } ] }