CVE-2025-58591
Full vulnerability record from the local CVENow database.
Description
A remote, unauthorized attacker can brute force folders and files and read them like private keys or configurations, making the application vulnerable for gathering sensitive information.
Severity
HIGH
CVSS score
7.5
(v3.1)
Vulnerability status
Analyzed
Source identifier
Published
2025-10-06 07:15:36.043000
Last modified
2026-10-18 21:10:00.120000
View original CVE JSON
{
"id": "CVE-2025-58591",
"sourceIdentifier": "[email protected]",
"published": "2025-10-06T07:15:36.043",
"lastModified": "2026-10-18T21:10:00.120",
"vulnStatus": "Analyzed",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "A remote, unauthorized attacker can brute force folders and files and read them like private keys or configurations, making the application vulnerable for gathering sensitive information."
},
{
"lang": "es",
"value": "Un atacante remoto y no autorizado puede forzar por fuerza bruta carpetas y archivos y leerlos como claves privadas o configuraciones, haciendo la aplicación vulnerable para la recopilación de información sensible."
}
],
"affected": [
{
"source": "[email protected]",
"affectedData": [
{
"vendor": "SICK AG",
"product": "Baggage Analytics",
"defaultStatus": "affected",
"versions": [
{
"version": "0",
"lessThan": "4.6.3",
"versionType": "custom",
"status": "affected"
}
]
},
{
"vendor": "SICK AG",
"product": "Tire Analytics",
"defaultStatus": "affected",
"versions": [
{
"version": "0",
"lessThan": "4.6.3",
"versionType": "custom",
"status": "affected"
}
]
},
{
"vendor": "SICK AG",
"product": "Package Analytics",
"defaultStatus": "affected",
"versions": [
{
"version": "0",
"lessThan": "4.6.3",
"versionType": "custom",
"status": "affected"
}
]
},
{
"vendor": "SICK AG",
"product": "Logistic Diagnostic Analytics",
"defaultStatus": "affected",
"versions": [
{
"version": "0",
"lessThan": "4.6.3",
"versionType": "custom",
"status": "affected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"availabilityImpact": "NONE"
},
"exploitabilityScore": 2.8,
"impactScore": 3.6
},
{
"source": "[email protected]",
"type": "Primary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"availabilityImpact": "NONE"
},
"exploitabilityScore": 3.9,
"impactScore": 3.6
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2025-10-06T17:37:24.282184Z",
"id": "CVE-2025-58591",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-22"
}
]
}
],
"configurations": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:sick:baggage_analytics:*:*:*:*:*:*:*:*",
"matchCriteriaId": "E62416BA-1BF1-43BD-98B2-57BD34128419"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:sick:logistic_diagnostic_analytics:*:*:*:*:*:*:*:*",
"matchCriteriaId": "27031959-2981-4755-9E3D-02CD083F2B72"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:sick:package_analytics:*:*:*:*:*:*:*:*",
"matchCriteriaId": "5955214B-0D71-449A-BFD4-8804FDF91CA1"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:sick:tire_analytics:*:*:*:*:*:*:*:*",
"matchCriteriaId": "86C0BA69-E701-45A3-ADA5-130B8AD9DF15"
}
]
}
]
}
],
"references": [
{
"url": "https://sick.com/psirt",
"source": "[email protected]",
"tags": [
"Vendor Advisory"
]
},
{
"url": "https://www.cisa.gov/resources-tools/resources/ics-recommended-practices",
"source": "[email protected]",
"tags": [
"US Government Resource"
]
},
{
"url": "https://www.first.org/cvss/calculator/3.1",
"source": "[email protected]",
"tags": [
"Not Applicable"
]
},
{
"url": "https://www.sick.com/.well-known/csaf/white/2025/sca-2025-0010.json",
"source": "[email protected]",
"tags": [
"Vendor Advisory"
]
},
{
"url": "https://www.sick.com/.well-known/csaf/white/2025/sca-2025-0010.pdf",
"source": "[email protected]",
"tags": [
"Vendor Advisory"
]
},
{
"url": "https://www.sick.com/media/docs/9/19/719/special_information_sick_operating_guidelines_cybersecurity_by_sick_en_im0106719.pdf",
"source": "[email protected]",
"tags": [
"Product"
]
}
]
}