SICK Baggage Analytics CVE-2025-58589

Exploitation requires an authenticated session (CVSS PR:L) to a SICK Baggage Analytics, Logistic Diagnostic Analytics, Package Analytics, or Tire Analytics web application, plus the ability to trigger an application error (e.g., malformed input or an unexpected condition) that causes the backend to emit a full, unhandled stacktrace to the client. The limiting factors are: valid low-privilege credentials are mandatory (no unauthenticated access), the disclosed content is limited to internal class/method names and structural/technology details rather than user data or secrets, and impact is confidentiality-only with no integrity or availability effect. Realistic exposure is confined to deployments where these niche analytics products are network-reachable by the authenticated user population.

This is a moderate-severity information disclosure flaw (CVE-2025-58589, CWE-200) in several SICK AG analytics products. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, score 6.5) indicates a network-reachable, low-complexity issue requiring low-privilege authentication (PR:L) with no user interaction, affecting only confidentiality. The real-world risk signals are consistently LOW-to-MODERATE: EPSS is only 0.36% (28th percentile), the CVE is NOT listed in CISA KEV, and no public exploit code was identified in the provided data. These signals align - there is no evidence of active or imminent widespread exploitation. One notable discrepancy: the vendor-supplied vector rates confidentiality as C:H, which appears aggressive for a vulnerability that discloses only stacktraces (class/method names and internal structure) rather than sensitive user data or credentials; C:L would be more defensible, and this likely inflates the 6.5 base score. The flaw is primarily useful as a reconnaissance aid feeding a larger attack chain rather than being directly impactful. Because exploitation requires an authenticated account (PR:L), exposure is limited to users who can already reach and log into these industrial/logistics analytics applications. Overall: a genuine but low-priority defense-in-depth hardening item, not an urgent emergency.

An authenticated low-privileged user of a SICK analytics application (e.g., Package Analytics) submits a malformed request or triggers an application error, causing the backend to return a full Java-style stacktrace. The attacker harvests class names, method names, framework/version details, and internal structure to map the technology stack and plan follow-on attacks. No public exploit code is known; the attack requires only normal authenticated interaction with error-producing inputs.