SICK Enterprise Analytics CVE-2025-58583

Exploitation requires network access to the application's login-protected H2 database interface used for caching; the disclosure occurs because the username field is prefilled on that login page. The key LIMITING factor is that the H2 database itself remains login (password) protected, so this yields disclosure of a valid username and system information rather than full database access - meaningful full compromise would still require the corresponding password. Impact is therefore constrained to information leakage useful for follow-on credential attacks against SICK Enterprise Analytics.

This is a low-to-moderate severity information-disclosure issue (CVSS 5.3) that signals exposure rather than a high-priority emergency. The CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates a network-reachable, low-complexity, unauthenticated issue, but the only confidentiality impact is C:L with no integrity or availability impact (I:N/A:N) and no scope change (S:U) - consistent with CWE-497 (exposure of sensitive system information). EPSS is low at 0.36% (28th percentile), the CVE is NOT listed in CISA KEV, and no public exploit code is referenced, so there is no evidence of active exploitation. There is tension worth noting: the vector claims PR:N (unauthenticated) and the CWE implies pure information leakage, yet the description states the H2 database is 'login protected' with only a prefilled username - meaning a password is still required for full database access, so the realistic leak is limited to the disclosed username/system metadata rather than full cache contents. Net assessment: a genuine but minor hardening/information-disclosure defect in a niche industrial product, not a widespread exploitation priority - patch on a normal maintenance cadence.

A remote attacker reaches the login-protected H2 database console used for caching and observes that the username field is prefilled, disclosing a valid account name and system information that narrows subsequent credential attacks. No public exploit code is identified at time of analysis, and full access still requires the account password, so the practical outcome is reconnaissance-grade information disclosure rather than direct data compromise.