CVE-2025-58579

MediumCVSS 5.3/10Last modified Oct 18, 2026

Description

Due to a lack of authentication, it is possible for an unauthenticated user to request data from this endpoint, making the application vulnerable for user enumeration.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-497

Affected software

Vendor	Product	Versions
SICK AG	Baggage Analytics	< 4.6.3
SICK AG	Tire Analytics	< 4.6.3
SICK AG	Package Analytics	< 4.6.3
SICK AG	Logistic Diagnostic Analytics	< 4.6.3
SICK AG	Enterprise Analytics	all versions

References

https://sick.com/psirtVendor Advisory
https://www.cisa.gov/resources-tools/resources/ics-recommended-practicesUS Government Resource
https://www.first.org/cvss/calculator/3.1Not Applicable
https://www.sick.com/.well-known/csaf/white/2025/sca-2025-0010.jsonVendor Advisory
https://www.sick.com/.well-known/csaf/white/2025/sca-2025-0010.pdfVendor Advisory
https://www.sick.com/media/docs/9/19/719/special_information_sick_operating_guidelines_cybersecurity_by_sick_en_im0106719.pdfProduct

Timeline

Published: Oct 6, 2025
Last modified: Oct 18, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-58588.8A vulnerability was found in PHPGurukul Nipah Virus Testing Management System 1.0. It has been classified as critical. Affected is an unknow CVE-2025-585805.3An API endpoint allows arbitrary log entries to be created via POST request. Without sufficient validation of the input data, CVE-2025-585814.3When an error occurs in the application a full stacktrace is provided to the user. The stacktrace lists class and method names as well as o CVE-2025-585827.5If a user tries to login but the provided credentials are incorrect a log is created. The data for this POST requests is not validated and i CVE-2025-585835.3The application provides access to a login protected H2 database for caching purposes. The username is prefilled.CVE-2025-585847.5In the HTTP request, the username and password are transferred directly in the URL as parameters. However, URLs can be stored in various sys CVE-2025-585857.5Multiple endpoints with sensitive information do not require authentication, making the application susceptible to information gathering.CVE-2025-585865.3For failed login attempts, the application returns different error messages depending on whether the login failed due to an incorrect passwo CVE-2025-585879.8The application does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame, making CVE-2025-585896.5When an error occurs in the application a full stacktrace is provided to the user. The stacktrace lists class and method names as well as ot CVE-2025-58598.8A vulnerability was found in PHPGurukul Nipah Virus Testing Management System 1.0. It has been declared as critical. Affected by this vulner CVE-2025-585907.5It's possible to brute force folders and files, what can be used by an attacker to steal sensitve information.