CVE-2025-58582

If a user tries to login but the provided credentials are incorrect a log is created. The data for this POST requests is not validated and it’s possible to send giant payloads which are then logged.

CVSS v3 5.3 MEDIUM

5.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 3.9 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact LOW

Scope UNCHANGED

References

Link	Resource
https://sick.com/psirt	Vendor Advisory
https://www.cisa.gov/resources-tools/resources/ics-recommended-practices	US Government Resource
https://www.first.org/cvss/calculator/3.1	Not Applicable
https://www.sick.com/.well-known/csaf/white/2025/sca-2025-0010.json	Vendor Advisory
https://www.sick.com/.well-known/csaf/white/2025/sca-2025-0010.pdf	Vendor Advisory
https://www.sick.com/media/docs/9/19/719/special_information_sick_operating_guidelines_cybersecurity_by_sick_en_im0106719.pdf	Product

Configurations

Configuration 1 (hide)

cpe:2.3:a:sick:enterprise_analytics:*:*:*:*:*:*:*:*

History

09 Oct 2026, 10:10

Type	Values Removed	Values Added
Summary		(es) Si un usuario intenta iniciar sesión pero las credenciales proporcionadas son incorrectas, se crea un registro. Los datos para estas solicitudes POST no son validados y es posible enviar cargas útiles gigantes que luego se registran.

Information

Published : 2025-10-06 07:15

Updated : 2026-10-09 10:10

NVD link : CVE-2025-58582

Mitre link : CVE-2025-58582

CVE.ORG link : CVE-2025-58582

JSON object : View

Products Affected

sick

enterprise_analytics

CWE

CWE-770

Allocation of Resources Without Limits or Throttling

{"id": "CVE-2025-58582", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-58582", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2025-10-06T12:16:51.621488Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "psirt@sick.de", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 3.9}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "affected": [{"source": "psirt@sick.de", "affectedData": [{"vendor": "SICK AG", "product": "Enterprise Analytics", "versions": [{"status": "affected", "version": "all versions", "versionType": "custom"}], "defaultStatus": "affected"}]}], "published": "2025-10-06T07:15:34.733", "references": [{"url": "https://sick.com/psirt", "tags": ["Vendor Advisory"], "source": "psirt@sick.de"}, {"url": "https://www.cisa.gov/resources-tools/resources/ics-recommended-practices", "tags": ["US Government Resource"], "source": "psirt@sick.de"}, {"url": "https://www.first.org/cvss/calculator/3.1", "tags": ["Not Applicable"], "source": "psirt@sick.de"}, {"url": "https://www.sick.com/.well-known/csaf/white/2025/sca-2025-0010.json", "tags": ["Vendor Advisory"], "source": "psirt@sick.de"}, {"url": "https://www.sick.com/.well-known/csaf/white/2025/sca-2025-0010.pdf", "tags": ["Vendor Advisory"], "source": "psirt@sick.de"}, {"url": "https://www.sick.com/media/docs/9/19/719/special_information_sick_operating_guidelines_cybersecurity_by_sick_en_im0106719.pdf", "tags": ["Product"], "source": "psirt@sick.de"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "psirt@sick.de", "description": [{"lang": "en", "value": "CWE-770"}]}], "descriptions": [{"lang": "en", "value": "If a user tries to login but the provided credentials are incorrect a log is created. The data for this POST requests is not validated and it\u2019s possible to send giant payloads which are then logged."}, {"lang": "es", "value": "Si un usuario intenta iniciar sesi\u00f3n pero las credenciales proporcionadas son incorrectas, se crea un registro. Los datos para estas solicitudes POST no son validados y es posible enviar cargas \u00fatiles gigantes que luego se registran."}], "lastModified": "2026-10-09T10:10:00.193", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:sick:enterprise_analytics:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "04E8EA78-2780-40C0-B5BA-6CF99DE6355B"}], "operator": "OR"}]}], "sourceIdentifier": "psirt@sick.de"}