In brief · As of October 2026
SICK technology in a plant consists of Flexi Soft safety controllers (FX3-CPU with expansion modules on the internal bus and a gateway module), safety laser scanners (microScan3, nanoScan3) on PROFINET, EtherNet/IP or EtherCAT, SIG200/SIG350 IO-Link masters with sensors, cameras and lidar on the network. From the maintenance PC, PROFINET variants provide part number, serial number and firmware via I&M0, EtherNet/IP variants via ListIdentity, cameras and lidar via web identification; the Flexi Soft modules behind the gateway, EtherCAT scanners and IO-Link sensors are only seen by the controller or the master: Safety Designer, SOPAS or the REST interface of the SIG master. SICK publishes as CSAF in its own provider with the part number as skus, often for ‘all versions’: 71 advisories, 13 new in 2026. We did not find an SBOM; for the plant you do not need one.
What hangs on a Flexi Soft controller and what of it is visible on the network
A Flexi Soft consists of the main module FX3-CPU, expansion modules (inputs/outputs, speed, relays) on the internal bus and a gateway (FX3-GPNT PROFINET, FX3-GEPR EtherNet/IP, FX3-GECA EtherCAT). Attached via EFI-pro or directly on the network are safety laser scanners, via SIG200/SIG350 masters IO-Link sensors, plus cameras (InspectorP, Lector), lidar (LMS, MRS, multiScan) and encoders.
- Visible via IP from the maintenance PC: FX3-GPNT gateways, microScan3 and nanoScan3 PROFINET variants and SIG masters via DCP and I&M0 (OrderID = part number, serial number, firmware); EtherNet/IP variants via ListIdentity; cameras and lidar via web identification or the SOPAS protocol.
- Only via the controller or the master: FX3-CPU and expansion modules behind the gateway (the gateway reports only itself), EtherCAT scanners behind a third-party master and IO-Link sensors behind SIG masters.
- Only from the engineering: sensors without firmware and without IO-Link; they are in the bill of materials, not in the plant SBOM.
How Flexi Soft modules and IO-Link sensors get into the list: Safety Designer, SOPAS, SIG master
The Safety Designer shows the module list of the Flexi Soft online with type, part number, serial number and firmware per module; SOPAS provides the same for scanners and sensors. The SIG master lists its IO-Link ports with VendorID, DeviceID and product name via the web interface, as PROFINET submodules or via its REST interface. From the network, the following are added:
- SOPAS Engineering Tool and Safety Designer (Flexi Soft, Flexi Compact, microScan3): projects with device type, part number and firmware.
- PROFINET I&M0: microScan3 PROFINET/PROFIsafe variants, Flexi Soft gateways FX0-GPNT and SIG200/SIG350 IO-Link masters are PI-certified and return OrderID, serial number and firmware via DCP.
- EtherNet/IP (CIP Safety) and EtherCAT (FSoE) depending on the variant – EtherCAT scanners only via the master. IO-Link sensors behind SIG masters via their interface. Background in the article on the network scan.
- Cameras (InspectorP, Lector) and lidar (LMS, MRS, multiScan) are IP devices with a web interface; the firmware is shown there, not in the PLC.
How SICK publishes advisories and what matching runs on
The SICK PSIRT links security advisories, RSS feed and “Security Advisory CSAF-Feed” directly; the provider-metadata.json names SICK PSIRT as Trusted Provider and also covers the joint venture with Endress+Hauser. On the measurement day the feed held 77 entries, six of them duplicates due to upper/lower case in the IDs – a detail that matching has to take into account.
| Measurement (7 Oct 2026) | Result |
|---|
| Unique CSAF advisories | 71 (2019–2026) |
| of which new in 2026 | 13 (SCA-2026-0001 to -0013, latest 11 Sep 2026) |
| Published or updated in 2026 | 15 |
| New documents 2022 / 2023 / 2024 / 2025 | 15 / 11 / 7 / 14 |
| Documents with CPE / PURL / model_numbers (sample) | 0 / 0 / 0 – identification via skus |
| CISA OT feed: entries mentioning SICK | 1 (none from 2026) |
An earlier look at the same feed (2025) found around 258 distinct CVEs across 71 advisories – an indication that SICK consistently tracks third-party components such as CodeMeter (sca-2026-0011) as well. Affected products are listed with name and part number; the version range is frequently vers:all/*, meaning “all versions”.
The SICK part number is printed on every nameplate and appears in every EPLAN parts list; matching via skus is therefore robust. Two peculiarities: first, the same product can run under several part numbers per variant (microScan3 Core, Pro, EtherCAT), and an advisory lists them individually. Second, vers:all/* means that no firmware version is clear – there is nothing to patch here, but an assessment of exploitability per plant and, where necessary, a measure on the network.
That safety laser scanners and safety controllers are missing from many device lists, although they carry firmware and appear in the advisory feed, is the most common finding at acceptance tests. 13 advisories in nine months is not a manufacturer that can be left out.
We did not find any SBOM provision at SICK; for the plant you do not need one, the advisories name the part number.
What this means for installations with SICK components
- Record part number and firmware for each scanner, safety controller, camera, lidar and IO-Link master – from SOPAS/Safety Designer and via I&M0.
- For
vers:all/*, document the assessment per plant; there is no target version to wait for.
13 advisories in nine months, often for ‘all versions’, and the safety controller shows only its gateway on the network. In Werkspilot Scan, SICK is stage 1 for gateways, PROFINET scanners and SIG masters via I&M0 and ListIdentity, and stage 3 for the Flexi Soft modules and IO-Link sensors behind them via controller and master. We are currently trialling the third stage with development partners on their plants.
All 13 manufacturers compared: SBOM by manufacturer →
Trial Werkspilot Scan on your own plant.
We are trialling the capture with a few plant builders on their test or reference plants, for four months, extended stage by stage around their controllers. The partner gets one plant of their choice as a plant SBOM: every reachable device with manufacturer, order number and firmware version, open items listed individually.
Ask about the development partnership →
Werkspilot keeps these devices per plant and reports when an advisory hits one of them. The figures in this article are our own measurements from 7 Oct 2026; manufacturers change feeds and pages without notice.
