SICK Baggage Analytics CVE-2025-58591

No special conditions beyond network reachability of the affected application's file-serving/web interface - the CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates remote, unauthenticated exploitation requiring no user interaction against the SICK Baggage Analytics, Logistic Diagnostic Analytics, Package Analytics, and Tire Analytics products. Realistic exploitation depends on the attacker having network access to the application (these are specialized industrial analytics tools typically deployed on operational/segmented networks rather than the public internet, per SICK's own operating-guidelines and CISA ICS recommended-practice references), which is the primary limiting factor. Impact is confined to confidentiality (I:N/A:N): the attacker can read files such as private keys and configurations but cannot, through this flaw alone, modify data or disrupt availability.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, base 7.5) describes a network-reachable, low-complexity, unauthenticated path-traversal flaw with high confidentiality impact and no integrity or availability impact - fully consistent with the CWE-22 classification and the description's claim that an unauthorized remote attacker can brute-force and read files such as private keys and configurations. All signals that are present agree with one another, so there is no internal contradiction between the vector and the description. However, several exploitation-priority signals are simply ABSENT from the input: no EPSS probability was supplied, there is no CISA KEV listing, and no proof-of-concept is referenced. Therefore active exploitation cannot be asserted - no public exploit is identified at the time of analysis. This looks like a genuinely high-severity information-disclosure bug (exposure of private keys would be serious), but its real-world priority is tempered by the affected products being specialized SICK industrial analytics applications rather than ubiquitous internet-facing software, which typically limits mass-scanning opportunity. Net: a credible high-confidentiality issue worth prompt patching where these SICK products are deployed, but with no evidence of in-the-wild exploitation to date; missing EPSS/KEV/POC data means the exploitation-likelihood dimension is unverified rather than confirmed low.

A remote, unauthenticated attacker reaches the web interface of a SICK analytics application and submits requests containing traversal sequences, iterating over candidate paths to brute-force the locations of sensitive files. Because the flaw requires no authentication and has low attack complexity (AV:N/AC:L/PR:N), the attacker reads back private keys and configuration files to harvest credentials and secrets. No public proof-of-concept is referenced in the provided data.