CVE-2025-49181

{"id": "CVE-2025-49181", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "psirt@sick.de", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.6, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 4.7, "exploitabilityScore": 3.9}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.6, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 4.7, "exploitabilityScore": 3.9}]}, "published": "2025-06-12T14:15:30.270", "references": [{"url": "https://cdn.sick.com/media/docs/1/11/411/Special_information_CYBERSECURITY_BY_SICK_en_IM0084411.PDF", "tags": ["Broken Link"], "source": "psirt@sick.de"}, {"url": "https://sick.com/psirt", "tags": ["Vendor Advisory"], "source": "psirt@sick.de"}, {"url": "https://www.cisa.gov/resources-tools/resources/ics-recommended-practices", "tags": ["US Government Resource"], "source": "psirt@sick.de"}, {"url": "https://www.first.org/cvss/calculator/3.1", "tags": ["Not Applicable"], "source": "psirt@sick.de"}, {"url": "https://www.sick.com/.well-known/csaf/white/2025/sca-2025-0007.json", "tags": ["Vendor Advisory"], "source": "psirt@sick.de"}, {"url": "https://www.sick.com/.well-known/csaf/white/2025/sca-2025-0007.pdf", "tags": ["Vendor Advisory"], "source": "psirt@sick.de"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "psirt@sick.de", "description": [{"lang": "en", "value": "CWE-862"}]}], "descriptions": [{"lang": "en", "value": "Due to missing authorization of an API endpoint, unauthorized users can send HTTP GET\nrequests to gather sensitive information. An attacker could also send HTTP POST requests to modify\nthe log files\u2019 root path as well as the TCP ports the service is running on, leading to a Denial of Service\nattack."}, {"lang": "es", "value": "Debido a la falta de autorizaci\u00f3n de un endpoint de API, usuarios no autorizados pueden enviar solicitudes HTTP GET para recopilar informaci\u00f3n confidencial. Un atacante tambi\u00e9n podr\u00eda enviar solicitudes HTTP POST para modificar la ruta ra\u00edz de los archivos de registro, as\u00ed como los puertos TCP en los que se ejecuta el servicio, lo que provoca un ataque de denegaci\u00f3n de servicio."}], "lastModified": "2026-02-03T14:35:29.270", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:sick:media_server:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9541865D-6BDE-45B8-AA6C-5858592F43FA"}], "operator": "OR"}]}], "sourceIdentifier": "psirt@sick.de"}