CVE-2025-49199

Katalog CVE

CVSS 9.8 · Critical EPSS 0,33%

Kerentanan Insufficient Verification of Data Authenticity pada sick field analytics. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

The backup ZIPs are not signed by the application, leading to the possibility that an attacker can download a backup ZIP, modify and re-upload it. This allows the attacker to disrupt the application by configuring the services in a way that they are unable to run, making the application unusable. They can redirect traffic that is meant to be internal to their own hosted services and gathering information.

Rincian

Terbit di NVD

12 Juni 2025

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-345: Insufficient Verification of Data Authenticity

EPSS (30 hari)

0,33% peluang dieksploitasi; lebih tinggi dari 24,0% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://sick.com/psirt advisory vendor
• https://www.sick.com/.well-known/csaf/white/2025/sca-2025-0007.json advisory vendor
• https://www.sick.com/.well-known/csaf/white/2025/sca-2025-0007.pdf advisory vendor
• https://www.cisa.gov/resources-tools/resources/ics-recommended-practices pemerintah AS
• https://cdn.sick.com/media/docs/1/11/411/Special_information_CYBERSECURITY_BY_SICK_en_IM0084411.PDF broken link
• https://www.first.org/cvss/calculator/3.1 not applicable