What is the CVSS score of CVE-2025-59461?

CVE-2025-59461 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of SICK TLOC100-100 are affected by CVE-2025-59461?

The SICK TLOC100-100 localization devices are affected by a critical vulnerability that allows unauthenticated remote attackers to read, modify, or disrupt sensitive data and device services.

How to fix or mitigate CVE-2025-59461?

Within 24 hours, inventory all SICK TLOC100-100 devices, immediately isolate them from untrusted networks, and restrict access to the C++ API to only essential authorized hosts using firewall rules or network segmentation. Within 7 days, implement monitoring for unauthorized access attempts on the API, review device logs for anomalies, and apply any interim mitigations from vendor advisory SCA-2025-0013. Within 30 days, develop a plan to deploy a firmware update once released, conduct a risk assessment for any remaining exposure, and consider additional compensating controls such as disabling unnecessary services or deploying an intrusion detection system. Continuously monitor the vendor advisory for patch availability.

SICK TLOC100-100 CVE-2025-59461

CRITICAL

Missing Authorization (CWE-862)

2025-10-27 psirt@sick.de

Authentication Bypass Information Disclosure Tloc100 100 Firmware

9.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Description explicitly states a remote unauthenticated API (AV:N/AC:L/PR:N/UI:N) that can access, modify data and disrupt service, giving full C:H/I:H/A:H on the same device (S:U).

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Oct 08, 2026 - 11:51 vuln.today

CVE Published

Oct 27, 2025 - 11:15 nvd

CRITICAL 9.8

DescriptionNVD

A remote unauthenticated attacker may use the unauthenticated C++ API to access or modify sensitive data and disrupt services.

AnalysisAI

The unauthenticated C++ API exposed by SICK TLOC100-100 localization devices performs no authorization checks, letting any remote, unauthenticated attacker who can reach the interface read or modify sensitive data and disrupt device services, yielding a CVSS v3.1 base score of 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) for full confidentiality, integrity and availability impact. All firmware versions matching cpe:2.3:o:sick:tloc100-100_firmware:* are in scope according to the vendor's PSIRT advisory (SCA-2025-0013). Exploitation is not confirmed active (no CISA KEV listing) and no public exploit identified at time of analysis; EPSS is a modest 0.49% (40th percentile), which is consistent with the practical constraint that TLOC100 units normally sit on segmented OT/plant networks rather than internet-facing infrastructure.

Technical ContextAI

The root cause is CWE-862 (Missing Authorization): the device exposes a C++ API that is reachable without authentication and, per the advisory description, performs no authorization on requests, so sensitive operations can be invoked by anyone with network reachability. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H confirms a network-reachable, low-complexity, unauthenticated and interaction-free attack with high impact across all three CIA pillars and no scope change, meaning the vulnerable component itself is fully compromised. The affected CPE, cpe:2.3:o:sick:tloc100-100_firmware:*:*:*:*:*:*:*:*, identifies the embedded firmware of the SICK TLOC100-100, an industrial localization/tracking device typically used in automated logistics and material-handling environments. Because the weakness is architectural (an API with no authentication/authorization layer) rather than a memory-safety or injection bug, no special feature toggle, non-default mode or user action is cited as a prerequisite; the primary real-world gating factor is deployment context, since these units are engineered for segmented OT networks and are only exploitable if the interface is reachable by the attacker.

RemediationAI

No vendor-released patch version is identified in the available advisory data at time of analysis, so operators should first confirm the current fixed-firmware status directly with SICK through the PSIRT advisory SCA-2025-0013 (https://www.sick.com/.well-known/csaf/white/2025/sca-2025-0013.json or the PDF at https://www.sick.com/.well-known/csaf/white/2025/sca-2025-0013.pdf and https://sick.com/psirt) before planning upgrades. Until a patched firmware is confirmed and deployed, the effective compensating control is network containment, since exploitation depends on reachability of the unauthenticated C++ API: place TLOC100-100 devices on a dedicated, segmented OT VLAN with no route from corporate, Wi-Fi or internet-facing networks, and enforce deny-by-default ACLs or a firewall in front of the device that permits only the specific management hosts and ports genuinely required (a whitelist that must be maintained or device management breaks). Blocking or filtering the API's TCP/UDP ports from all non-management segments removes the attack path entirely but will also disable any legitimate integrations consuming that API, so inventory those integrations first. Additional measures per CISA ICS guidance include restricting physical and logical access to the device, monitoring for unexpected configuration changes or unexplained service restarts as indicators of unauthorized API use, and applying the SICK cybersecurity operating guidelines referenced above. Because the vulnerability is inherent to the API's missing authentication, there is no configuration-only fix such as a credential or feature toggle identified in the supplied data, and network isolation should be treated as the primary interim mitigation until a vendor firmware release is available and validated.