CVE-2025-49181

Katalog CVE

CVSS 8.6 · High EPSS 0,40%

Kerentanan Missing Authorization pada sick media server. Skor CVSS 3.1 8.6 (High) menurut NVD.

Deskripsi (NVD)

Due to missing authorization of an API endpoint, unauthorized users can send HTTP GET requests to gather sensitive information. An attacker could also send HTTP POST requests to modify the log files’ root path as well as the TCP ports the service is running on, leading to a Denial of Service attack.

Rincian

Terbit di NVD

12 Juni 2025

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

8.6 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-862: Missing Authorization

EPSS (30 hari)

0,40% peluang dieksploitasi; lebih tinggi dari 32,6% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://sick.com/psirt advisory vendor
• https://www.sick.com/.well-known/csaf/white/2025/sca-2025-0007.json advisory vendor
• https://www.sick.com/.well-known/csaf/white/2025/sca-2025-0007.pdf advisory vendor
• https://www.cisa.gov/resources-tools/resources/ics-recommended-practices pemerintah AS
• https://cdn.sick.com/media/docs/1/11/411/Special_information_CYBERSECURITY_BY_SICK_en_IM0084411.PDF broken link
• https://www.first.org/cvss/calculator/3.1 not applicable