An attacker can exploit a missing access control in the AppEngine Fileaccess feature exposed over HTTP, allowing unauthenticated read and write operations against sensitive filesystem directories. The flaw exposes device configuration files, including customer‑defined passwords, and enables the injection of arbitrary Lua code into the sandboxed AppEngine environment, effectively granting remote code execution capabilities. The underlying weakness is identified as a sensitive file inclusion and disclosure flaw, consistent with CWE‑552.

The vulnerability affects SICK AG’s Lector 83x and Lector 85x product lines. No specific pre‑release version numbers are listed, but the vendor recommends any affected instance to upgrade to release 2.8.0, implying the flaw is present in prior releases of these families.

With a CVSS score of 9.8, the vulnerability is categorised as critical. Epistemic probability of exploitation is reported as below 1% by EPSS, and it is not listed in the CISA Known Exploited Vulnerabilities catalog, indicating low current exploitation likelihood. Nonetheless, the flaw remains remotely exploitable over the device’s HTTP interface without authentication, meaning that any network segment with traffic to the device is potentially at risk. The combination of high impact and low probability suggests that decisive mitigation actions are warranted to prevent any future exploitation.