SICK Analytics Dashboards CVE-2025-9913

Exploitation requires the victim to use the affected SICK analytics dashboard (Baggage Analytics, Logistic Diagnostic Analytics, Package Analytics, or Tire Analytics) and to interact with the 'Open in new Tab' button, which fails to sanitize a javascript: URI that then executes in the address-bar/browser context (UI:R). Limiting factors: the attack needs user interaction (a victim must trigger the vulnerable button) and realistically an active dashboard session to hijack, impact is confined to the victim's browser session (limited C/I, no availability impact), and the affected products are specialized industrial logistics analytics applications with narrow deployment. Although the supplied CVSS lists PR:N, the dashboard-based trigger suggests an authenticated operator may be the realistic target - confirm with SICK advisory SCA-2025-0010.

This is a reflected/DOM-based cross-site scripting issue (CWE-79) in SICK's analytics web dashboards, rated CVSS 6.1 (Medium) with vector AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. The CVSS signals a network-reachable, low-complexity flaw that requires no privileges but does require user interaction (UI:R) and crosses a trust boundary (S:C), with only limited confidentiality and integrity impact and no availability impact - consistent with session hijacking via script execution in the victim's browser rather than direct server compromise. Corroborating lower-risk signals: EPSS is 0.29% (20th percentile), there is no CISA KEV listing, and no public exploit code was identified, so this is no public exploit identified at time of analysis. No SSVC decision data was provided in the input. Overall this reads as a genuine but non-urgent, moderate-priority web vulnerability - the low EPSS, absence of KEV/POC, user-interaction requirement, and niche industrial-software footprint all argue against widespread opportunistic exploitation. One caveat to verify: the vector lists PR:N, but the flaw is triggered through a dashboard 'Open in new Tab' button, which may in practice require an authenticated dashboard session - verify the real authentication context with the SICK advisory (SCA-2025-0010) before treating it as fully unauthenticated.

An attacker crafts a malicious input/link that, when rendered by the SICK analytics dashboard's 'Open in new Tab' feature, places a javascript: URI into the address bar so that attacker-controlled script executes in the victim's authenticated browser context. When an operator interacts with the poisoned dashboard element (UI:R), the script runs and steals session tokens or cookies, enabling session hijacking of the analytics application. No public proof-of-concept was identified in the provided data.