CVE-2025-9913
Full vulnerability record from the local CVENow database.
Description
JavaScript can be ran inside the address bar via the dashboard "Open in new Tab" Button, making the application vulnerable to session hijacking.
Severity
MEDIUM
CVSS score
6.1
(v3.1)
Vulnerability status
Analyzed
Source identifier
Published
2025-10-06 07:15:36.200000
Last modified
2026-10-18 21:10:00.120000
View original CVE JSON
{
"id": "CVE-2025-9913",
"sourceIdentifier": "[email protected]",
"published": "2025-10-06T07:15:36.200",
"lastModified": "2026-10-18T21:10:00.120",
"vulnStatus": "Analyzed",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "JavaScript can be ran inside the address bar via the dashboard \"Open in new Tab\" Button, making the application vulnerable to session hijacking."
},
{
"lang": "es",
"value": "JavaScript puede ejecutarse dentro de la barra de direcciones a través del botón 'Abrir en nueva pestaña' del panel de control, haciendo que la aplicación sea vulnerable al secuestro de sesión."
}
],
"affected": [
{
"source": "[email protected]",
"affectedData": [
{
"vendor": "SICK AG",
"product": "Baggage Analytics",
"defaultStatus": "affected",
"versions": [
{
"version": "0",
"lessThan": "4.6.3",
"versionType": "custom",
"status": "affected"
}
]
},
{
"vendor": "SICK AG",
"product": "Tire Analytics",
"defaultStatus": "affected",
"versions": [
{
"version": "0",
"lessThan": "4.6.3",
"versionType": "custom",
"status": "affected"
}
]
},
{
"vendor": "SICK AG",
"product": "Package Analytics",
"defaultStatus": "affected",
"versions": [
{
"version": "0",
"lessThan": "4.6.3",
"versionType": "custom",
"status": "affected"
}
]
},
{
"vendor": "SICK AG",
"product": "Logistic Diagnostic Analytics",
"defaultStatus": "affected",
"versions": [
{
"version": "0",
"lessThan": "4.6.3",
"versionType": "custom",
"status": "affected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N",
"baseScore": 4.5,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "HIGH",
"userInteraction": "REQUIRED",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"availabilityImpact": "NONE"
},
"exploitabilityScore": 0.9,
"impactScore": 3.6
},
{
"source": "[email protected]",
"type": "Primary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "REQUIRED",
"scope": "CHANGED",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"availabilityImpact": "NONE"
},
"exploitabilityScore": 2.8,
"impactScore": 2.7
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2025-10-06T12:22:58.518086Z",
"id": "CVE-2025-9913",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-79"
}
]
}
],
"configurations": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:sick:baggage_analytics:*:*:*:*:*:*:*:*",
"matchCriteriaId": "E62416BA-1BF1-43BD-98B2-57BD34128419"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:sick:logistic_diagnostic_analytics:*:*:*:*:*:*:*:*",
"matchCriteriaId": "27031959-2981-4755-9E3D-02CD083F2B72"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:sick:package_analytics:*:*:*:*:*:*:*:*",
"matchCriteriaId": "5955214B-0D71-449A-BFD4-8804FDF91CA1"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:sick:tire_analytics:*:*:*:*:*:*:*:*",
"matchCriteriaId": "86C0BA69-E701-45A3-ADA5-130B8AD9DF15"
}
]
}
]
}
],
"references": [
{
"url": "https://sick.com/psirt",
"source": "[email protected]",
"tags": [
"Vendor Advisory"
]
},
{
"url": "https://www.cisa.gov/resources-tools/resources/ics-recommended-practices",
"source": "[email protected]",
"tags": [
"US Government Resource"
]
},
{
"url": "https://www.first.org/cvss/calculator/3.1",
"source": "[email protected]",
"tags": [
"Not Applicable"
]
},
{
"url": "https://www.sick.com/.well-known/csaf/white/2025/sca-2025-0010.json",
"source": "[email protected]",
"tags": [
"Vendor Advisory"
]
},
{
"url": "https://www.sick.com/.well-known/csaf/white/2025/sca-2025-0010.pdf",
"source": "[email protected]",
"tags": [
"Vendor Advisory"
]
},
{
"url": "https://www.sick.com/media/docs/9/19/719/special_information_sick_operating_guidelines_cybersecurity_by_sick_en_im0106719.pdf",
"source": "[email protected]",
"tags": [
"Product"
]
}
]
}