SICK Analytics CVE-2025-9914

Exploitation requires network reachability to the login interface of an affected SICK Analytics product (Baggage Analytics, Logistic Diagnostic Analytics, Package Analytics, or Tire Analytics) and relies on credentials stored in the system's local database being usable for authentication (CWE-288 authentication bypass via an unintended authentication path). Limiting factors: only confidentiality is affected (no integrity or availability impact); exploitation depends on the local-database authentication mechanism being present and the Analytics service being network-exposed rather than segmented behind ICS network controls, which SICK's own cybersecurity operating guidelines recommend. The description does not name a specific toggle, but the vendor advisory SCA-2025-0010 should be consulted for the exact affected versions and whether a non-default configuration is involved.

The input provides a confirmed CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N = 7.5 HIGH), indicating a network-reachable, low-complexity, unauthenticated flaw affecting only confidentiality. However, EPSS is not supplied, there is no CISA KEV listing, and no public POC is referenced, so exploitation status is 'no public exploit identified at time of analysis.' The absence of exploitation telemetry combined with the niche nature of the affected SICK analytics products suggests this is a moderate-priority, not an emergency-tier, issue despite the HIGH score. A notable tension exists between the CVSS vector and the description: the vector asserts PR:N (unauthenticated) while the description states that credentials stored in the local database 'can be used for the log in' - this reads more like an authentication-bypass/alternate-authentication-path weakness (CWE-288) than a pure no-credentials-needed flaw, so the exact precondition should be verified against SICK advisory SCA-2025-0010. Impact is confidentiality-only (C:H, I:N, A:N), so there is no confirmed integrity or availability risk from this specific weakness.

A remote attacker reaches the network-exposed login interface of a SICK Analytics application (e.g., Package or Baggage Analytics) and leverages credentials held in the system's local database to authenticate as a legitimate user without proper authorization, per the CWE-288 authentication-bypass pattern. The low attack complexity (AC:L) and lack of required user interaction (UI:N) make this straightforward once the service is reachable. No public exploit code is identified at time of analysis, so exploitation would currently require independent development.