« Volver al listado

CVE-2025-49193

Estado: AnalizadaMedia (6.1)—

The application fails to implement several security headers. These headers help increase the overall security level of the web application by e.g., preventing the application to be displayed in an iFrame (Clickjacking attacks) or not executing injected malicious JavaScript code (XSS attacks).

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (6)

Sick — Baggage AnalyticsSick — Field AnalyticsSick — Logistic Diagnostic AnalyticsSick — Media ServerSick — Package AnalyticsSick — Tire Analytics

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2025-49193",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-49193",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-06-12T14:33:45.757872Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "psirt@sick.de",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 4.2,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "REQUIRED",
          "attackComplexity": "HIGH",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 2.5,
        "exploitabilityScore": 1.6
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 6.1,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 2.7,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "psirt@sick.de",
      "affectedData": [
        {
          "vendor": "SICK AG",
          "product": "Field Analytics",
          "versions": [
            {
              "status": "affected",
              "version": "all versions",
              "versionType": "custom"
            }
          ],
          "defaultStatus": "affected"
        },
        {
          "vendor": "SICK AG",
          "product": "Media Server",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "lessThan": "1.5",
              "versionType": "custom"
            }
          ],
          "defaultStatus": "unaffected"
        },
        {
          "vendor": "SICK AG",
          "product": "Baggage Analytics",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "lessThan": "4.6.3",
              "versionType": "custom"
            }
          ],
          "defaultStatus": "affected"
        },
        {
          "vendor": "SICK AG",
          "product": "Tire Analytics",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "lessThan": "4.6.3",
              "versionType": "custom"
            }
          ],
          "defaultStatus": "affected"
        },
        {
          "vendor": "SICK AG",
          "product": "Package Analytics",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "lessThan": "4.6.3",
              "versionType": "custom"
            }
          ],
          "defaultStatus": "affected"
        },
        {
          "vendor": "SICK AG",
          "product": "Logistic Diagnostic Analytics",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "lessThan": "4.6.3",
              "versionType": "custom"
            }
          ],
          "defaultStatus": "affected"
        }
      ]
    }
  ],
  "published": "2025-06-12T15:15:39.433",
  "references": [
    {
      "url": "https://cdn.sick.com/media/docs/1/11/411/Special_information_CYBERSECURITY_BY_SICK_en_IM0084411.PDF",
      "tags": [
        "Broken Link"
      ],
      "source": "psirt@sick.de"
    },
    {
      "url": "https://sick.com/psirt",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "psirt@sick.de"
    },
    {
      "url": "https://www.cisa.gov/resources-tools/resources/ics-recommended-practices",
      "tags": [
        "US Government Resource"
      ],
      "source": "psirt@sick.de"
    },
    {
      "url": "https://www.first.org/cvss/calculator/3.1",
      "tags": [
        "Not Applicable"
      ],
      "source": "psirt@sick.de"
    },
    {
      "url": "https://www.sick.com/.well-known/csaf/white/2025/sca-2025-0007.json",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "psirt@sick.de"
    },
    {
      "url": "https://www.sick.com/.well-known/csaf/white/2025/sca-2025-0007.pdf",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "psirt@sick.de"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "psirt@sick.de",
      "description": [
        {
          "lang": "en",
          "value": "CWE-693"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "The application fails to implement several security headers. These headers help increase the overall security level of the web application by e.g., preventing the application to be displayed in an iFrame (Clickjacking attacks) or not executing injected malicious JavaScript code (XSS attacks)."
    },
    {
      "lang": "es",
      "value": "La aplicación no implementa varios encabezados de seguridad. Estos encabezados ayudan a aumentar el nivel general de seguridad de la aplicación web, por ejemplo, impidiendo que la aplicación se muestre en un iFrame (ataques de clickjacking) o que se ejecute código JavaScript malicioso inyectado (ataques XSS)."
    }
  ],
  "lastModified": "2026-06-17T09:30:54.603",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:sick:baggage_analytics:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E62416BA-1BF1-43BD-98B2-57BD34128419"
            },
            {
              "criteria": "cpe:2.3:a:sick:field_analytics:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "62EE84A7-E93D-411E-A6FC-4BEE5F4CD16D"
            },
            {
              "criteria": "cpe:2.3:a:sick:logistic_diagnostic_analytics:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "27031959-2981-4755-9E3D-02CD083F2B72"
            },
            {
              "criteria": "cpe:2.3:a:sick:media_server:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "818583F6-0347-4D38-863F-5D1C391C427E",
              "versionEndExcluding": "1.5"
            },
            {
              "criteria": "cpe:2.3:a:sick:package_analytics:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "5955214B-0D71-449A-BFD4-8804FDF91CA1"
            },
            {
              "criteria": "cpe:2.3:a:sick:tire_analytics:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "86C0BA69-E701-45A3-ADA5-130B8AD9DF15"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "psirt@sick.de"
}