SICK Enterprise Analytics CVE-2025-58582

No special configuration is required: the flaw is reachable against the standard login functionality of SICK Enterprise Analytics. The specific precondition is simply that an attacker can reach the authentication/login POST endpoint over the network and submit a request with incorrect credentials - the application logs the failed-attempt POST data without validating or bounding its size (CWE-770). Exploitation is limited only by network reachability to the login interface; because PR:N and UI:N, no authentication or user interaction is needed. Realistic limiting factors are therefore network-level controls (whether the login endpoint is internet-exposed versus segmented behind ICS/OT network boundaries) and any upstream request-size limits imposed by a reverse proxy or WAF, which could blunt the oversized-payload vector.

This is a genuine but moderate-priority availability issue, not an overstated high-CVSS finding. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) legitimately supports remote, unauthenticated, low-complexity exploitation with no user interaction, and the sole impact is availability (C:N/I:N/A:H) - consistent with CWE-770 (unbounded resource allocation) and the 'Denial Of Service' tag. However, supporting signals temper the urgency: EPSS is only 0.55% (44th percentile), the CVE is NOT in CISA KEV, and no public exploit code is referenced, so there is no evidence of active or widespread exploitation. The attack is trivially performed (sending an oversized POST to a failed-login endpoint that logs unvalidated data), but the payoff is limited to service/log-storage exhaustion rather than code execution or data compromise. No SSVC decision data was provided in the input, so automatability and technical-impact scoring cannot be cross-referenced. Net: real and easy to trigger, but low real-world exploitation pressure and bounded impact make this an important patch-when-convenient item rather than an emergency, especially given the niche ICS/analytics product footprint.

A remote, unauthenticated attacker repeatedly submits login requests with intentionally incorrect credentials but attaches extremely large, unvalidated payloads in the POST body. Each failed attempt is written to logs without size limits, progressively consuming disk, memory, or logging-pipeline resources until the SICK Enterprise Analytics service degrades or becomes unavailable. No public proof-of-concept is referenced, but the technique requires only an HTTP client and knowledge of the login endpoint.