CVE-2026-1626 covers weak CBC based cipher suites in the SSH service of SICK LMS1000 and MRS1000 laser scanners, rated 6.5 (medium). SICK recommends upgrading to firmware release 2.4.1. Until then, keep the devices off untrusted networks and turn off SSH where nobody needs it.
What's affected
- Products: SICK LMS1000 and SICK MRS1000 product families.
- Affected: firmware 2.4.0 and earlier.
- Fixed: firmware 2.4.1, per SICK's advisory SCA-2026-0005.
- Companion CVE: the same advisory covers CVE-2026-1627, which concerns weak MAC algorithms in the same SSH service.
- Severity: 6.5 with the record's CWE-327 (use of a broken or risky cryptographic algorithm). The vector requires user interaction. Not on the CISA Known Exploited Vulnerabilities list.
How to check if you're exposed
Check the firmware version in the device's configuration software, and compare it with 2.4.1. Make a list of the SKUs in your plants, since the MRS1000 family covers several.
To see what the SSH service offers, scan a device from a management host you control, with permission:
nmap --script ssh2-enum-algos -p 22 <device-address>
Look for CBC ciphers and older MAC algorithms in the output. After upgrading, run it again to confirm the list has changed.
What to do now
- List every LMS1000 and MRS1000 device and its firmware version.
- Upgrade to firmware 2.4.1 following SICK's instructions, in a maintenance window agreed with operations.
- Follow SICK's general advice: minimize network exposure, restrict access, and run devices in a protected network.
- Disable SSH on devices where nobody needs it.
- Check that the devices are not reachable from the internet or from office networks.
Why it matters
CBC mode ciphers in SSH have known weaknesses when an attacker can watch or interfere with the traffic. SICK's advisory says an attacker able to intercept or interact with the traffic might observe or manipulate parts of the encrypted communication. The use of weak algorithms is the weakness class CWE-327.
The conditions are narrow: network position, and user interaction in the record's vector. That is why the score is medium. Industrial sensors, however, tend to sit on flat networks and to stay unpatched for years. The cheapest control is segmentation, and the advisory lists it first.
Plan the firmware update with the people who run the equipment. Sensors are part of a safety or production process, and an update needs a window and a test.
Quick check
Which firmware fixes it?
SICK recommends release 2.4.1 for both product families.
What about CVE-2026-1627?
It is a sibling issue about weak MAC algorithms in the same SSH service, with the same fixed firmware.
Sources
Last reviewed: 19 October 2026.
