CyberAlerts is shutting down on June 30th, 2025. Thank you for your support!
CVE-2025-49183: Credential disclosure
7.5
CVSS
Description
All communication with the REST API is unencrypted (HTTP), allowing an attacker to intercept traffic between an actor and the webserver. This leads to the possibility of information gathering and downloading media files.
Classification
CVE ID: CVE-2025-49183
CVSS Base Severity: HIGH
CVSS Base Score: 7.5
CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Problem Types
CWE-319 Cleartext Transmission of Sensitive InformationAffected Products
Vendor: SICK AG
Product: SICK Media Server
Exploit Prediction Scoring System (EPSS)
EPSS Score: 0.02% (probability of being exploited)
EPSS Percentile: 3.33% (scored less or equal to compared to others)
EPSS Date: 2025-06-21 (when was this score calculated)
Stakeholder-Specific Vulnerability Categorization (SSVC)
SSVC Exploitation: none
SSVC Technical Impact: partial
SSVC Automatable: true
References
https://nvd.nist.gov/vuln/detail/CVE-2025-49183https://sick.com/psirt
https://cdn.sick.com/media/docs/1/11/411/Special_information_CYBERSECURITY_BY_SICK_en_IM0084411.PDF
https://www.cisa.gov/resources-tools/resources/ics-recommended-practices
https://www.first.org/cvss/calculator/3.1
https://www.sick.com/.well-known/csaf/white/2025/sca-2025-0007.pdf
https://www.sick.com/.well-known/csaf/white/2025/sca-2025-0007.json