SICK Analytics CVE-2025-58587

Exploitation requires network reachability to the authentication/login interface of an affected SICK Analytics product (Baggage, Enterprise, Logistic Diagnostic, Package, or Tire Analytics) and at least one valid or guessable username; the core enabling condition is the application's absence of lockout/throttling after repeated failed logins. Success is LIMITED by actual password strength and by the attacker's ability to determine a valid username, and by any compensating controls (network segmentation, upstream WAF/rate-limiting, MFA) deployed in front of the application - these industrial products are frequently on segmented OT/logistics networks rather than internet-facing, materially reducing real-world reach.

This is CWE-307 (improper restriction of excessive authentication attempts) across SICK's Analytics product line, enabling credential brute-force/guessing. The NVD CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H = 9.8 Critical) models the OUTCOME of a successful guess (full account takeover) rather than the weakness itself, which somewhat inflates the independent severity: real exploitability depends heavily on password strength, any compensating lockout at other layers, and network reachability of the login interface. No EPSS score, KEV listing, or POC was provided in the input, so there is no signal of active or probable exploitation - no public exploit identified at time of analysis. No SSVC decision data was supplied. Net assessment: a genuinely serious authentication-hardening gap, but the 9.8 'Critical' rating overstates independent risk for a rate-limiting flaw whose success is conditional on guessable credentials; treat as high-priority hardening rather than confirmed imminent compromise, especially given these are niche industrial/logistics analytics products with a limited exposure footprint.

An attacker with network access to the login endpoint of a SICK Analytics application (e.g. Package or Baggage Analytics) scripts automated high-volume credential guessing against a known or enumerated username. Because the application does not throttle or lock out repeated failed attempts, the attacker can iterate through password/credential lists until a valid credential is found, then log in with that user's privileges. No public exploit code is required - standard brute-force or credential-stuffing tooling suffices given AV:N/AC:L.