What is the CVSS score of CVE-2025-59462?

CVE-2025-59462 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.5%.

Which versions of SICK TLOC100-100 are affected by CVE-2025-59462?

A high-severity denial-of-service flaw in SICK TLOC100-100 firmware can allow an attacker with reachable access to the device's UpdateService interface to crash that service mid-transfer, temporarily…

How to fix or mitigate CVE-2025-59462?

Within 24 hours, inventory all SICK TLOC100-100 devices, confirm affected firmware versions against the vendor advisory, and immediately restrict network access to the UpdateService interface using firewall rules or ACLs so that only authorized management hosts and trusted update workstations can reach it; verify that no such devices are directly internet-exposed. Within 7 days, confirm no vendor patch has been released for the affected SICK TLOC100-100 firmware, register for SICK security notifications, and implement interim mitigations including network segmentation of the update interface to a dedicated management VLAN, disabling or blocking the UpdateService when not in active use, and enabling logging/alerting so that repeated service crashes or failed file transfers are detected and escalated. Within 30 days, schedule maintenance windows to apply the vendor-released firmware fix as soon as it becomes available, validate that update traffic is source-restricted and monitored on an ongoing basis, and review incident response procedures so operators know how to restart a crashed update service and verify device integrity after any unexplained outage.

SICK TLOC100-100 CVE-2025-59462

HIGH

Uncaught Exception (CWE-248)

2025-10-27 psirt@sick.de

Denial Of Service Sick Tloc100 100 Firmware

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

6.5 MEDIUM

Network-reachable UpdateService crash with low complexity; PR:L chosen because exploitation requires a controllable/connected client interacting during transfers, and only availability is impacted (A:H).

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Metadata Corrected

Oct 08, 2026 - 12:40 vuln.today

tag: Sick added

Analysis Generated

Oct 08, 2026 - 11:51 vuln.today

CVE Published

Oct 27, 2025 - 11:15 nvd

HIGH 7.5

DescriptionNVD

An attacker who tampers with the C++ CLI client may crash the UpdateService during file transfers, disrupting updates and availability.

AnalysisAI

Denial of service in the SICK TLOC100-100 firmware allows remote attackers who can interact with the UpdateService using a tampered C++ CLI client to crash the service during file transfers, disrupting update availability. The flaw is an uncaught exception (CWE-248) that triggers under timing- and feature-specific conditions when malformed client input is processed mid-transfer. No public exploit code or active exploitation has been identified, and EPSS is low at 0.55%; the high CVSS score of 7.5 reflects a worst-case availability impact but real-world risk is moderated by the need to reach and drive the update interface.

Technical ContextAI

The SICK TLOC100-100 is an industrial device whose firmware includes an UpdateService component that handles firmware or file updates over the network, typically driven by a C++ CLI client. The vulnerability is classified as CWE-248: Uncaught Exception, meaning the UpdateService fails to properly handle unexpected or malformed input from a tampered client during an active file transfer, causing the service process to crash. The CPE cpe:2.3:o:sick:tloc100-100_firmware:*:*:*:*:*:*:*:* indicates that all versions of the firmware are potentially affected unless a specific patched version is applied. The attack surface is limited to the UpdateService and the impact is availability-only; the independent assessment notes that exploitation requires the attacker to control a client capable of connecting to the service and initiating a file transfer, suggesting that network reachability and the ability to drive the update interface are prerequisites. The vendor's CVSS vector (PR:N) and the independent assessment (PR:L) differ on authentication requirements, so the actual exposure depends on the device's default network configuration and whether the UpdateService is accessible without credentials.

RemediationAI

No vendor-released patch identified at time of analysis. Monitor SICK's PSIRT advisory page (https://sick.com/psirt) and the CSAF document SCA-2025-0013 for forthcoming patches. Until a fix is available, restrict network access to the UpdateService to trusted management hosts using firewall rules or network segmentation, acknowledging that this may impede legitimate remote updates. If remote updates are not required, consider disabling the UpdateService entirely, but this prevents firmware updates over the network. Additionally, verify whether the UpdateService is exposed pre-authentication in the default configuration and enforce authentication or access controls where possible, though the CLI client tampering suggests that client-side controls are insufficient. Follow CISA ICS recommended practices (https://www.cisa.gov/resources-tools/resources/ics-recommended-practices) for defense-in-depth, including monitoring for crashes and unusual update traffic.