CVE-2025-49188

Medium CVSS: 5.3

The application sends user credentials as URL parameters instead of POST bodies, making it vulnerable to information gathering.

Vendor

Product

CWE

Yayın Tarihi

2025-06-12 14:15:31

Güncelleme

2026-01-29 17:32:55

Source Identifier

psirt@sick.de

KEV Date Added

CWE-598 Field Analytics MEDIUM Sick 2025

https://cdn.sick.com/media/docs/1/11/411/Special_information_CYBERSECURITY_BY_SICK_en_IM0084411.PDF https://sick.com/psirt https://www.cisa.gov/resources-tools/resources/ics-recommended-practices https://www.first.org/cvss/calculator/3.1 https://www.sick.com/.well-known/csaf/white/2025/sca-2025-0007.json https://www.sick.com/.well-known/csaf/white/2025/sca-2025-0007.pdf

Medium

CVE-2026-1627

An attacker may exploit the use of outdated and weak MAC algorithms in the device’s SSH service to potentially compromis…

Medium

CVE-2026-1626

An attacker may exploit the use of weak CBC-based cipher suites in the device’s SSH service to potentially observe or ma…

Medium

CVE-2026-22644

Certain requests pass the authentication token in the URL as string query parameter, making it vulnerable to theft throu…

Medium

CVE-2026-22645

The application discloses all used components, versions and license information to unauthenticated actors, giving attack…

Medium

CVE-2026-22646

Certain error messages returned by the application expose internal system details that should not be visible to end user…

Low

CVE-2026-22920

The device's passwords have not been adequately salted, making them vulnerable to password extraction attacks.