CVE-2026-1626 identifies a cryptographic vulnerability in the SICK AG LMS1000 device, specifically within its SSH service implementation. The device uses weak CBC (Cipher Block Chaining) mode cipher suites, which are known to be susceptible to cryptographic attacks such as padding oracle attacks or other ciphertext manipulation techniques. These weaknesses can allow an attacker who can intercept or interact with the network traffic to partially observe or manipulate encrypted SSH communications. The vulnerability is classified under CWE-327, indicating the use of broken or risky cryptographic algorithms. The CVSS v3.1 base score is 6.5 (medium), reflecting that the attack vector is network-based with low attack complexity and no privileges required, but user interaction is necessary (e.g., initiating an SSH session). The scope is unchanged, and the impact is primarily on confidentiality, with no direct impact on integrity or availability. No patches or firmware updates are currently linked, and no known exploits have been reported in the wild. The vulnerability highlights the importance of using modern, secure cipher suites such as AES-GCM or ChaCha20-Poly1305 in SSH implementations to prevent cryptographic attacks. The affected product, SICK LMS1000, is used in industrial and automation contexts, where secure remote management via SSH is critical.

The primary impact of this vulnerability is the potential compromise of confidentiality for SSH sessions to the SICK LMS1000 device. An attacker able to intercept network traffic could exploit the weak CBC cipher suites to decrypt or manipulate parts of the SSH communication, potentially exposing sensitive operational data or credentials. This could lead to unauthorized information disclosure, which in industrial environments might reveal system configurations, operational parameters, or control commands. While the vulnerability does not directly affect integrity or availability, the exposure of sensitive data could facilitate further attacks, including unauthorized access or disruption. Organizations relying on the SICK LMS1000 for critical infrastructure or industrial automation may face increased risk of espionage or targeted attacks. The medium severity rating suggests a moderate risk, but the impact could be significant in high-security environments or where SSH is used for critical remote management.

1. Disable CBC-based cipher suites in the SSH configuration of the SICK LMS1000 device to prevent use of weak cryptographic algorithms. 2. Enforce the use of modern, secure cipher suites such as AES-GCM or ChaCha20-Poly1305 that provide authenticated encryption and are resistant to known cryptographic attacks. 3. Monitor network traffic for unusual SSH activity that could indicate attempts to exploit this vulnerability. 4. Restrict SSH access to trusted networks and use network segmentation to limit exposure of the device to untrusted actors. 5. Implement strong authentication mechanisms and consider multi-factor authentication for SSH access to reduce risk if confidentiality is compromised. 6. Stay informed about firmware updates or patches from SICK AG addressing this vulnerability and apply them promptly once available. 7. Conduct regular security assessments and penetration testing focused on cryptographic configurations of industrial devices. 8. Educate operational technology (OT) and security teams about the risks of weak cryptographic algorithms and the importance of secure SSH configurations.