SICK Enterprise Analytics CVE-2025-58580

Exploitation requires network reachability to the specific SICK Enterprise Analytics API endpoint that accepts log-creation POST requests; the flaw is the absence of input validation on that endpoint, allowing arbitrary/forged log entries. Per the CVSS vector (PR:N/UI:N) no authentication or user interaction is required, so in deployments where this API is network-exposed, a remote unauthenticated attacker can trigger it. The practical limiting factors are network exposure of the analytics API (industrial deployments are often segmented behind OT/ICS network boundaries, per the referenced CISA ICS recommended practices) and the fact that impact is confined to log/audit integrity rather than system compromise.

This is a moderate-severity, low-priority issue. The input CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N, base 5.3) indicates a network-reachable, low-complexity, unauthenticated flaw, but with impact limited strictly to integrity (I:L) and no confidentiality or availability consequence - consistent with CWE-117 (improper output neutralization for logs / log injection). The EPSS score of 0.36% (28th percentile) signals low near-term exploitation probability, and there is no CISA KEV listing and no public proof-of-concept, so all exploitation signals point the same direction: this is a genuine but low-urgency weakness rather than an active threat. No SSVC decision data was provided. The signals are internally consistent - the only caveat is that log falsification is a secondary/enabling weakness (it undermines audit integrity and incident response) rather than a direct compromise vector, so its practical risk depends heavily on how much the environment relies on these logs for security monitoring. Note that the 'Information Disclosure' tag conflicts with the CVSS vector (C:N, no confidentiality impact) and the CWE-117 classification; treat that tag as suspect.

An attacker sends crafted POST requests to the exposed logging API endpoint of SICK Enterprise Analytics, injecting forged or malformed log entries that are written without input validation. By flooding or spoofing log data, the attacker dilutes genuine events, forges misleading records, or hides traces of other activity, undermining audit integrity and incident investigation. No public exploit is required - the operation is a straightforward unauthenticated HTTP request per the CVSS vector.