What is the CVSS score of CVE-2025-59459?

CVE-2025-59459 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.3%.

Which versions of SICK TLoc100-100 are affected by CVE-2025-59459?

SICK TLoc100-100 firmware contains a high-severity denial-of-service vulnerability that can cause a persistent outage requiring manual recovery, disrupting organizations that rely on these devices…

How to fix or mitigate CVE-2025-59459?

Within 24 hours, inventory all SICK TLoc100-100 devices, restrict SSH access to essential personnel with unique strong credentials and multi-factor authentication where possible, and disable SSH if not operationally required. Within 7 days, implement network segmentation to limit SSH access to trusted management networks, enforce least privilege for non-root accounts, and enable logging and monitoring for resource exhaustion or repeated authentication attempts. Within 30 days, engage SICK support to obtain a timeline for a firmware fix, apply any vendor-provided mitigations or workarounds as they become available, and review credential management practices to eliminate shared accounts and ensure prompt revocation of access for departed staff.

SICK TLoc100-100 CVE-2025-59459

HIGH

Allocation of Resources Without Limits or Throttling (CWE-770)

2025-10-27 psirt@sick.de

Denial Of Service Sick Tloc100 100 Firmware

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

6.5 MEDIUM

Description requires SSH access to an unprivileged account, so PR:L (not the published PR:N); network-reachable and low-complexity, availability-only impact with no confidentiality or integrity effect.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Metadata Corrected

Oct 08, 2026 - 12:40 vuln.today

tag: Sick added

Analysis Generated

Oct 08, 2026 - 11:51 vuln.today

CVE Published

Oct 27, 2025 - 11:15 nvd

HIGH 7.5

DescriptionNVD

An attacker that gains SSH access to an unprivileged account may be able to disrupt services (including SSH), causing persistent loss of availability.

AnalysisAI

Denial of service in SICK TLoc100-100 firmware allows an attacker who obtains SSH access to an unprivileged account to exhaust system resources, disrupting services including SSH itself and causing a persistent outage that may require manual recovery. Although the published CVSS vector indicates no privileges required (PR:N), our assessment confirms that valid SSH credentials for a non-root user are a prerequisite; it is not anonymously exploitable. No public exploit identified at time of analysis, and the EPSS score is low (0.34%, 26th percentile).

Technical ContextAI

The vulnerability is an uncontrolled resource consumption issue (CWE-770) in the firmware of SICK TLoc100-100 devices, a product used in industrial control systems. The CPE string cpe:2.3:o:sick:tloc100-100_firmware:*:*:*:*:*:*:*:* indicates that all firmware versions are potentially affected. An attacker with SSH access to an unprivileged account can trigger resource exhaustion-such as memory, file descriptors, or CPU-that impacts system services, including the SSH daemon, leading to loss of availability. The root cause is the absence of limits or throttling on resource allocation for authenticated SSH users. The published CVSS vector (PR:N) conflicts with our independent assessment (PR:L), which reflects the authentication prerequisite.

RemediationAI

No specific patch version is provided in the available intelligence; consult the SICK advisory at https://www.sick.com/.well-known/csaf/white/2025/sca-2025-0013.json for vendor remediation guidance. Until a patch is applied, restrict SSH access to trusted management networks using firewall rules or network segmentation, and enforce the principle of least privilege by limiting which accounts can log in via SSH. If SSH is not required, disable the service entirely. Monitor device resource usage for abnormal patterns that could indicate exploitation attempts. Note that these mitigations may reduce manageability and should be balanced against operational needs.