SICK Analytics CVE-2025-58584

Exploitation is only possible because the affected SICK Analytics applications (Baggage, Enterprise, Logistic Diagnostic, Package, and Tire Analytics) transmit the username and password as plaintext query parameters in the request URL. The concrete prerequisite is that those URLs be captured in a reachable secondary store - web server access logs, reverse/forwarding proxy logs, SIEM/log aggregation, or the operator's browser history - AND that the attacker obtain read access to one of those stores. Limiting factors: there is no direct over-the-network attack against the application itself; disclosure is passive and depends on credentials actually being logged and on the attacker reaching the log/proxy/history. This meaningfully constrains realistic exploitation compared to the AV:N/AC:L/PR:N CVSS reading.

This is a credentials-in-URL design flaw (CWE-598) in SICK's Analytics product line. NVD/SICK scored it CVSS 7.5 (AV:N/AC:L/PR:N/UI:N/C:H) - high because confidentiality impact is rated High and no authentication or interaction is listed. However, the signals point to a lower real-world priority than the 7.5 suggests: there is NO EPSS probability, NO CISA KEV listing, and NO public exploit code provided in the input, so this is 'no public exploit identified at time of analysis' rather than an active threat. Critically, the CVSS vector (AV:N/AC:L/PR:N) models the flaw as directly remotely exploitable, but the description makes clear that exploitation is PASSIVE and INDIRECT: an attacker does not attack the application over the network - they must obtain the credentials from a secondary store (server logs, reverse-proxy logs, browser history). That dependency on attacker access to a logging/proxy system is not reflected in the AC:L/PR:N metrics, so the official vector arguably overstates ease of exploitation. Net assessment: a legitimate confidentiality hygiene defect worth remediating, but not an urgent mass-exploitation priority - treat as medium real risk despite the High CVSS, especially given the niche industrial product footprint.

A SICK Analytics web client issues an HTTP request carrying the username and password as URL query parameters; these full URLs are written verbatim into the web server's access logs and any intervening reverse-proxy or forwarding-proxy logs. An attacker (or over-privileged insider) with read access to those logs, the SIEM aggregating them, or the operator's browser history harvests the plaintext credentials and reuses them to authenticate. No public exploit code is required or identified - the credentials are simply disclosed to anyone who can read a log line.