SICK Logistics Analytics CVE-2025-58590

Exploitation requires network reachability to the web/HTTP interface of an affected SICK application - Baggage Analytics, Logistic Diagnostic Analytics, Package Analytics, or Tire Analytics - against which an unauthenticated attacker submits path-traversal input (per PR:N/UI:N/AC:L); no special product feature toggle is named in the description. The primary limiting factor is deployment context: these are industrial logistics analytics products normally installed on segmented OT networks rather than the public internet, so realistic exploitation depends on the attacker first gaining access to that network segment. Impact is confined to confidentiality (file/folder disclosure); there is no integrity or availability effect, so it cannot directly modify data or disrupt operation.

The input CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/C:H/I:N/A:N, base 7.5) describes a network-reachable, low-complexity, unauthenticated path-traversal (CWE-22) with high confidentiality impact and no integrity or availability impact - consistent with information disclosure rather than code execution. No EPSS score was provided in the input, and there is no CISA KEV listing or POC indicator supplied, so exploitation signals are absent: this is no public exploit identified at time of analysis. The high CVSS is driven entirely by the confidentiality-only impact under unauthenticated remote access; however, the affected products (SICK Baggage/Logistic Diagnostic/Package/Tire Analytics) are specialized industrial-logistics analytics applications typically deployed on segmented OT/ICS networks, which materially lowers real-world internet-facing exposure versus the AV:N rating. Net: a genuine, patch-worthy information-disclosure flaw for operators of these SICK products, but likely targeted/limited rather than mass-exploited given the niche ICS deployment footprint - not a broad emergency absent exploitation evidence. Key missing data: no EPSS, no confirmed KEV/POC status in the input.

An attacker with network access to the web interface of a SICK Analytics application sends crafted requests containing directory-traversal sequences to read files and enumerate folders outside the intended web root, harvesting sensitive data such as configuration or credential material. Because the CVSS vector is PR:N/UI:N, no authentication or user interaction is required, only reachability of the service. No public exploit was identified in the provided data.