What is the CVSS score of CVE-2025-59463?

CVE-2025-59463 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.4%.

Which versions of SICK TLOC100-100 are affected by CVE-2025-59463?

The SICK TLOC100-100 industrial device firmware is affected by a high-severity, unauthenticated remote denial-of-service condition that can stall file transfers and block subsequent transfers,…

How to fix or mitigate CVE-2025-59463?

Within 24 hours, inventory all SICK TLOC100-100 devices, confirm firmware versions, and identify whether the file-transfer function is enabled or reachable from any untrusted network segment; if not required, disable the file-transfer service and block access at network boundaries, and contact SICK support for a fix or workaround since no vendor-released patch is available. Within 7 days, apply strict firewall and ACL rules plus OT segmentation to allow only trusted management hosts to reach the device, enable logging and alerting for repeated or failed file transfers and device unavailability, and test whether a deadlock can be recovered by restarting the transfer service or device under a controlled maintenance window. Within 30 days, implement ongoing monitoring and configuration baselines, validate that the TLOC100-100 devices are isolated from public or general corporate networks, and establish a plan to deploy the vendor patch once released; if the device is business-critical and cannot be fully isolated, document a risk acceptance with compensating controls and review it with OT and security leadership.

SICK TLOC100-100 CVE-2025-59463

HIGH

Deadlock (CWE-833)

2025-10-27 psirt@sick.de

Tloc100 100 Firmware

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

7.5 HIGH

Remote, no-auth, low-complexity trigger of a deadlock yields AV:N/AC:L/PR:N/UI:N; impact is availability-only (A:H) with C:N/I:N, matching CWE-833.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Metadata Corrected

Oct 08, 2026 - 12:40 vuln.today

tag: Information Disclosure removed

Analysis Generated

Oct 08, 2026 - 11:50 vuln.today

CVE Published

Oct 27, 2025 - 11:15 nvd

HIGH 7.5

DescriptionNVD

An attacker may cause chunk-size mismatches that block file transfers and prevent subsequent transfers.

AnalysisAI

Remote unauthenticated denial of service in the SICK TLOC100-100 industrial device firmware, where a file transfer submitted with a chunk-size value that does not match the actual payload triggers a deadlock (CWE-833) that blocks the transfer and prevents subsequent transfers from completing. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, base 7.5) confirms this is purely an availability impact - no confidentiality, integrity, or code-execution effect - and because the device is remote-reachable with no authentication or user interaction required, any attacker who can reach the file-transfer function on a reachable network segment can stall it. Risk is moderate in practice: no public exploit code has been identified at time of analysis, the CVE is not in CISA KEV, and EPSS is only 0.41% (33rd percentile), with the main limiting factor being that these are specialized industrial devices normally deployed on segmented OT/ICS networks rather than the public internet. Note that the 'Information Disclosure' tag attached to this record contradicts the CVSS vector (C:N) and the CWE-833 deadlock root cause, and should be disregarded.

Technical ContextAI

The flaw is a classic deadlock (CWE-833) in the firmware's chunked file-transfer handling of the SICK TLOC100-100. Chunked transfer protocols split a payload into discrete blocks, each announced with a size field that the receiver uses to allocate buffers and advance its state machine; when the declared chunk size does not match the bytes actually delivered, the transfer's producer and consumer can each wait on the other (for example, the receiver waiting for the remainder of an over-declared chunk while the sender has moved on or is waiting for an acknowledgement), producing a permanent stall instead of a clean error. Because the deadlock is not released, the transfer function does not return to a usable state and follow-on transfers are also blocked, which is what elevates a single malformed transfer into a sustained denial of service. The affected technology is embedded firmware on an industrial OT device, tracked by CPE cpe:2.3:o:sick:tloc100-100_firmware:*:*:*:*:*:*:*:* (all versions matched by the wildcard), and the absence of a C/I impact in the assessed vector confirms the defect is confined to resource/state handling rather than memory corruption, which is consistent with the reported-symptom description of blocked transfers. Vendor coordination and disclosure are documented in SICK advisory SCA-2025-0013.

RemediationAI

Apply the vendor fix for SICK TLOC100-100 firmware as specified in SICK advisory SCA-2025-0013 (CSAF JSON: https://www.sick.com/.well-known/csaf/white/2025/sca-2025-0013.json; PDF: https://www.sick.com/.well-known/csaf/white/2025/sca-2025-0013.pdf), which is the only authoritative source for the exact corrected firmware version - patch availability is per the vendor advisory and no specific fix version number is confirmed in the data provided here, so do not assume a version number that is not in the advisory. Because no vendor-released patch version is independently confirmed in this dataset, plan the upgrade with SICK support or an authorized integrator and schedule it in a maintenance window, since firmware changes on OT devices can interrupt production. Until the upgrade is applied, the most effective compensating control is network-layer: keep TLOC100-100 devices on segmented OT/ICS networks with no route to business IT or the internet, and restrict which hosts are permitted to reach the device's file-transfer service via OT-aware firewalls or ACLs - the trade-off is that legitimate engineering workstations and update servers must be explicitly whitelisted, and any host on the permitted segment can still mount the denial of service. If the file-transfer function is not operationally required, disabling that service on the device removes the attack surface entirely, at the cost of losing remote file operations and the associated maintenance workflows. Monitoring for repeated aborted or hung transfers and rate-limiting transfer submissions from untrusted sources can reduce - but not eliminate - the chance of a sustained lockup, and device restarts should be treated as a recovery action rather than a fix, since the deadlock will recur on the next malformed transfer. General hardening should follow CISA ICS recommended practices (https://www.cisa.gov/resources-tools/resources/ics-recommended-practices) and SICK's cybersecurity operating guidelines (https://www.sick.com/media/docs/9/19/719/special_information_sick_operating_guidelines_cybersecurity_by_sick_en_im0106719.pdf).