SICK Analytics CVE-2025-58579

Exploitation requires network reachability to the unauthenticated data endpoint exposed by the affected SICK Analytics products (Baggage, Enterprise, Logistic Diagnostic, Package, and Tire Analytics). Per the description, the endpoint lacks authentication, so no credentials, user interaction, or special configuration are needed (PR:N/UI:N/AC:L) against default deployments. The primary limiting factor is exposure: impact is confined to disclosure of valid usernames (C:L, no integrity/availability effect), and risk drops sharply when these operational-technology analytics applications are segmented behind a firewall/VPN and not reachable from untrusted networks, per SICK's cybersecurity operating guidelines.

This is a moderate, low-priority information-disclosure issue rather than a critical threat. The CVSS 3.1 base score of 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) indicates a network-reachable, unauthenticated, low-complexity flaw with only limited confidentiality impact and no integrity or availability impact - consistent with CWE-497 and the described user-enumeration weakness. No EPSS score, CISA KEV listing, or public proof-of-concept was provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation; exploitation status cannot be elevated beyond the raw CVSS signal. The signals are internally consistent (network vector matches an unauthenticated HTTP-style endpoint), so there is no CVSS-vs-description conflict to flag. The realistic value to an attacker is reconnaissance - harvesting valid usernames to seed password-spraying, phishing, or follow-on attacks against the identified SICK Analytics products - not direct compromise. Absent exploitation telemetry (EPSS/KEV/POC all unknown), treat this as a defense-in-depth hardening item, prioritized by whether the affected SICK Analytics endpoints are internet-exposed.

An unauthenticated attacker who can reach the affected SICK Analytics web endpoint over the network sends crafted requests to the vulnerable endpoint and observes response differences to confirm which usernames exist. The harvested account list is then reused for targeted password-spraying or phishing. No public proof-of-concept was provided, and the low attack complexity (AC:L) means no special timing or race conditions are required.