SICK TLoc100
CVE-2025-59460
HIGH
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach TLoc100 on network
-
ExploitConnect using permissive defaults
-
ExecutionAccess unauthorized interface
-
ImpactDisclose sensitive information
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Strong credential management
|
| Exploitation Conditions | Exploitation requires that the SICK TLoc100 device be operated in its default/factory configuration, in which access-restriction settings do not comply with current best practices, allowing unauthorized network connections. The limiting factor is network reachability to the device: the flaw is only practically exploitable where the device is accessible from an untrusted or inadequately segmented network, and it is mitigated by applying the hardening guidance in SICK's operating guidelines (special_information_sick_operating_guidelines_cybersecurity) and CISA ICS recommended practices, i.e., restricting access and not leaving default settings in place. Impact is limited to confidentiality (information disclosure); integrity and availability are not affected. |
| Impact | Signals are mixed and point to a modest, context-dependent risk rather than an urgent priority. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/C:H/I:N/A:N, 7.5) frames this as a remote, unauthenticated confidentiality-only issue, consistent with a device shipped in a default state whose access restrictions are too permissive (CWE-1391, weak/insufficient access controls). However, the EPSS probability is low (0.43%, 36th percentile), there is no CISA KEV listing, and no public exploit is identified, so there is no evidence of widespread or opportunistic exploitation. The confidentiality-only impact (I:N/A:N) and the fact that the weakness is a default-configuration hardening gap rather than a memory-corruption or auth-bypass bug further temper the real-world severity. Note a tension worth flagging: CVSS rates this PR:N/AV:N as if broadly network-reachable, but the actual risk hinges on whether the SICK TLoc100 device is exposed on an untrusted network - in a properly segmented OT/ICS environment the practical exposure is far lower than the 7.5 suggests. Treat this as a hardening/configuration item to remediate on affected SICK TLoc100 devices, prioritized by network exposure, not as an emergency patch. |
| Exploit ScenarioDerived | A SICK TLoc100 device is deployed with its default configuration, which does not sufficiently restrict inbound access. An attacker with network reachability to the device establishes an unauthorized connection and reads sensitive information exposed by the overly permissive default settings. No public proof-of-concept is known; exploitation requires only network access to a device left in its shipped state. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 18, 2026
SICK TLoc100-100 firmware shipped and left in its default state applies access-restriction settings that fall short of current best practices, so remote attackers who can reach the device over the network may open unauthorized connections and read sensitive information (confidentiality-only impact; integrity and availability are unaffected). The flaw is network-reachable and requires no credentials (CVSS:3.1/AV:N/AC:L/PR:N/UI:N), but it is only practically exploitable where the device is exposed to an untrusted or poorly segmented network, and it is fully mitigated by applying SICK's hardening guidance. There is no confirmed active exploitation (not in CISA KEV) and no public exploit identified at time of analysis; EPSS is low at 0.43% (36th percentile), so this ranks as a context-dependent, configuration-driven risk rather than an urgent one.
RemediationAI
No vendor-released patched version was identified in the available data; SICK's advisory SCA-2025-0013 (https://www.sick.com/.well-known/csaf/white/2025/sca-2025-0013.json and .pdf, portal https://sick.com/psirt) addresses the issue through configuration hardening, so the primary action is to take each TLoc100-100 out of its default state and apply the access-restriction settings defined in SICK's operating guidelines for cybersecurity (https://www.sick.com/media/docs/9/19/719/special_information_sick_operating_guidelines_cybersecurity_by_sick_en_im0106719.pdf) and in CISA's ICS recommended practices (https://www.cisa.gov/resources-tools/resources/ics-recommended-practices); verify with SICK whether a firmware update supersedes this guidance before relying on configuration alone. Where hardening cannot be completed immediately, restrict reachability: place the device behind a firewall or OT segmentation boundary that permits only the specific engineering and locating-infrastructure hosts that must talk to it, and disable any unused network services or management interfaces - the trade-off is that tight host allow-lists can break commissioning tools and asset-tracking integrations until those addresses are added, and aggressive service disabling can interrupt locating data flows. Because the impact is confidentiality-only and exploitation requires reachability, removing Internet exposure and eliminating flat-network access are the highest-value interim controls; rotate any default credentials as part of commissioning and re-validate the configuration after firmware changes or device replacement, since a factory reset reintroduces the vulnerable defaults.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The issue affects the firmware of the SICK TLoc100-100 (CPE cpe:2.3:o:sick:tloc100-100_firmware, wildcarded for all versions), an industrial device deployed in OT/ICS environments. NVD classifies the root cause as CWE-1391 (Use of Weak Credentials), which in this case manifests as an insecure default configuration: the unit ships with access-restriction settings that do not meet modern hardening baselines, leaving authentication and connection-control surfaces weaker than they should be. Because the weakness lives in shipped defaults rather than in a single parsing or memory-safety bug, the attack surface is the device's reachable network services, and the CVSS vector (AV:N/AC:L/PR:N/UI:N, C:H/I:N/A:N) reflects that any remote party able to route to the device can attempt connections without credentials, yielding information disclosure only. Practical exploitability therefore depends on network placement: devices sitting behind proper segmentation and reachable only from trusted engineering hosts are largely shielded, whereas units exposed on flat or Internet-facing networks inherit the full 7.5 severity. SICK's advisory (sca-2025-0013) and CISA's ICS recommended practices frame the fix as configuration hardening rather than a protocol-level code correction.
Know when Tloc100 100 Firmware gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Default permissive access allows an unauthenticated remote connection (AV:N/AC:L/PR:N/UI:N) exposing sensitive data, so C:H with no integrity or availability impact.
Primary rating from Vendor (sick).
CVSS VectorVendor: sick
DescriptionCVE.org
The system is deployed in its default state, with configuration settings that do not comply with the latest best practices for restricting access. This increases the risk of unauthorised connections.
Executive ViewAI
SICK TLoc100-100 devices in their default configuration may allow unauthenticated users with network reachability to read sensitive information, so the primary risk is confidentiality loss where devices are internet-facing or sit on untrusted segments. No public exploit identified at time of analysis and no vendor-released patch identified at time of analysis, making this a configuration-driven exposure that warrants containment and hardening rather than emergency enterprise response.
No vendor-released patch identified at time of analysis; interim mitigations include restricting network reachability to trusted segments, applying SICK hardening guidance, enforcing firewall and ACL rules, placing devices behind VPN access, disabling unused services, and monitoring for unauthorized connections.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Affected Products (CPE)CVE.org
More in Tloc100 100 Firmware
View allThe unauthenticated C++ API exposed by SICK TLOC100-100 localization devices performs no authorization checks, letting a
Denial of service in the SICK TLOC100-100 firmware allows remote attackers who can interact with the UpdateService using
Remote unauthenticated denial of service in the SICK TLOC100-100 industrial device firmware, where a file transfer submi
Denial of service in SICK TLoc100-100 firmware allows an attacker who obtains SSH access to an unprivileged account to e
GitHub PoC
Exploit-DB