JavaScript can be ran inside the address bar via the dashboard "Open in new Tab" Button, making the application vulnerable to session hijacking.
References
| Link | Resource |
|---|---|
| https://sick.com/psirt | Vendor Advisory |
| https://www.cisa.gov/resources-tools/resources/ics-recommended-practices | US Government Resource |
| https://www.first.org/cvss/calculator/3.1 | Not Applicable |
| https://www.sick.com/.well-known/csaf/white/2025/sca-2025-0010.json | Vendor Advisory |
| https://www.sick.com/.well-known/csaf/white/2025/sca-2025-0010.pdf | Vendor Advisory |
| https://www.sick.com/media/docs/9/19/719/special_information_sick_operating_guidelines_cybersecurity_by_sick_en_im0106719.pdf | Product |
Configurations
Configuration 1 (hide)
|
History
29 Jan 2026, 01:55
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Sick tire Analytics
Sick Sick logistic Diagnostic Analytics Sick baggage Analytics Sick package Analytics |
|
| CPE | cpe:2.3:a:sick:logistic_diagnostic_analytics:*:*:*:*:*:*:*:* cpe:2.3:a:sick:package_analytics:*:*:*:*:*:*:*:* cpe:2.3:a:sick:tire_analytics:*:*:*:*:*:*:*:* cpe:2.3:a:sick:baggage_analytics:*:*:*:*:*:*:*:* |
|
| References | () https://sick.com/psirt - Vendor Advisory | |
| References | () https://www.cisa.gov/resources-tools/resources/ics-recommended-practices - US Government Resource | |
| References | () https://www.first.org/cvss/calculator/3.1 - Not Applicable | |
| References | () https://www.sick.com/.well-known/csaf/white/2025/sca-2025-0010.json - Vendor Advisory | |
| References | () https://www.sick.com/.well-known/csaf/white/2025/sca-2025-0010.pdf - Vendor Advisory | |
| References | () https://www.sick.com/media/docs/9/19/719/special_information_sick_operating_guidelines_cybersecurity_by_sick_en_im0106719.pdf - Product |
06 Oct 2025, 07:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-10-06 07:15
Updated : 2026-01-29 01:55
NVD link : CVE-2025-9913
Mitre link : CVE-2025-9913
CVE.ORG link : CVE-2025-9913
JSON object : View
Products Affected
sick
- tire_analytics
- baggage_analytics
- logistic_diagnostic_analytics
- package_analytics
CWE
CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')