SICK AG vulnerabilities, page 2
115 vulnerabilities
Known vulnerabilities in SICK AG products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 98 products.
CVE-2025-58578sick agenterprise analytics
EPSS score0.32%
A user with the appropriate authorization can create any number of user accounts via an API endpoint using a POST request. There are no quotas, checking mechanisms or restrictions to limit the creation.CVE-2025-58581sick agenterprise analyticsEPSS score0.33%
When an error occurs in the application a full stacktrace is provided to the user. The stacktrace lists class and method names as well as other internal information. An attacker can thus obtain information about the technology used and the structure of the application.CVE-2025-58590sick agbaggage analytics+7EPSS score0.53%
It's possible to brute force folders and files, what can be used by an attacker to steal sensitve information.CVE-2025-58579sick agbaggage analytics+4EPSS score0.40%
Due to a lack of authentication, it is possible for an unauthenticated user to request data from this endpoint, making the application vulnerable for user enumeration.CVE-2025-27594sick agsick dl100-2xxxxxxxEPSS score0.45%
The device uses an unencrypted, proprietary protocol for communication. Through this protocol, configuration data is transmitted and device authentication is performed. An attacker can thereby intercept the authentication hash and use it to log into the device using a pass-the-hash attack.CVE-2025-27595sick agsick dl100-2xxxxxxxEPSS score0.54%
The device uses a weak hashing alghorithm to create the password hash. Hence, a matching password can be easily calculated by an attacker. This impacts the security and the integrity of the device.CVE-2025-27593sick agsick dl100-2xxxxxxxEPSS score0.41%
The product can be used to distribute malicious code using SDD Device Drivers due to missing download verification checks, leading to code execution on target systems.CVE-2025-49186avayamedia_server+5EPSS score0.37%
The product does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame, making it susceptible to brute-force attacks.CVE-2025-49188sick agsick field analyticsEPSS score0.44%
The application sends user credentials as URL parameters instead of POST bodies, making it vulnerable to information gathering.CVE-2025-49190sick agsick field analyticsEPSS score0.34%
The application is vulnerable to Server-Side Request Forgery (SSRF). An endpoint can be used to send server internal requests to other ports.CVE-2025-49196sick agsick field analyticsEPSS score0.26%
A service supports the use of a deprecated and unsafe TLS version. This could be exploited to expose sensitive information, modify data in unexpected ways or spoof identities of other users or devices, affecting the confidentiality and integrity of the device.CVE-2025-49194sick agsick media serverEPSS score0.32%
The server supports authentication methods in which credentials are sent in plaintext over unencrypted channels. If an attacker were to intercept traffic between a client and this server, the credentials would be exposed.CVE-2025-49198sick agsick media serverEPSS score0.38%
The Media Server’s authorization tokens have a poor quality of randomness. An attacker may be able to guess the token of an active user by computing plausible tokens.CVE-2025-49185sick agsick field analyticsEPSS score0.30%
The web application is susceptible to cross-site-scripting attacks. An attacker who can create new dashboard widgets can inject malicious JavaScript code into the Transform Function which will be executed when the widget receives data from its data source.CVE-2025-49200sick agsick field analyticsEPSS score0.47%
The created backup files are unencrypted, making the application vulnerable for gathering sensitive information by downloading and decompressing the backup files.CVE-2025-49181sick agsick media server+1EPSS score0.40%
Due to missing authorization of an API endpoint, unauthorized users can send HTTP GET
requests to gather sensitive information. An attacker could also send HTTP POST requests to modify
the log files’ root path as well as the TCP ports the service is running on, leading to a Denial of Service
attack.CVE-2025-49191sick agsick field analyticsEPSS score0.35%
Linked URLs during the creation of iFrame widgets and dashboards are vulnerable to code execution. The URLs get embedded as iFrame widgets, making it possible to attack other users that access the dashboard by including malicious code. The attack is only possible if the attacker is authorized to create new dashboards or iFrame widgets.CVE-2025-49184sick agbaggage analytics+5EPSS score0.49%
A remote unauthorized attacker may gather sensitive information of the application, due to missing authorization of configuration settings of the product.CVE-2025-49187sick agsick field analyticsEPSS score0.41%
For failed login attempts, the application returns different error messages depending on whether the login failed due to an incorrect password or a non-existing username. This allows an attacker to guess usernames until they find an existing one.CVE-2025-49192sick agsick field analytics+3EPSS score0.33%
The web application is vulnerable to clickjacking attacks. The site can be embedded into another frame, allowing an attacker to trick a user into clicking on something different from what the user perceives. This could potentially reveal confidential information or allow others to take control of their computer while clicking on seemingly innocuous objects.