Enterprise Analytics
Monthly
SICK Enterprise Analytics exposes a login-protected H2 database used for caching, and the login page renders with the username field prefilled - an unauthenticated remote attacker who can reach that interface (CVSS:3.1/AV:N/AC:L/PR:N/UI:N) can harvest a valid database username together with system/version information. The exposure is classified as CWE-497 (exposure of sensitive system information to an unauthorized control sphere) and is rated CVSS 5.3 with low confidentiality-only impact; the H2 database password is still required, so this yields reconnaissance value for follow-on credential attacks rather than direct database access. EPSS is 0.36% (28th percentile), there is no KEV listing, and no public exploit identified at time of analysis.
Unbounded logging in SICK Enterprise Analytics allows unauthenticated remote attackers to exhaust server resources by submitting oversized POST payloads to the login endpoint. When a login attempt fails, the application writes the request data to a log without validating or bounding its size (CWE-770), so repeated or very large submissions can flood logs and drive disk or memory consumption, degrading or halting the service. The flaw is network-reachable with no authentication or user interaction required (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, base 7.5), but impact is limited to availability. Exploitation status: no public exploit identified at time of analysis, and EPSS is low at 0.55% (44th percentile), consistent with a moderate-priority availability issue rather than an actively exploited one.
SICK Enterprise Analytics returns full application stack traces to authenticated users who trigger an error, disclosing internal class names, method names, and structural details of the application. The issue is rated CVSS 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) with a very low EPSS score of 0.33%, no public exploit identified at time of analysis, and no CISA KEV entry. This is a low-to-moderate priority information disclosure issue, not an urgent threat, with impact limited to confidentiality of diagnostic metadata and no integrity or availability effect.
SICK Enterprise Analytics exposes an API endpoint that accepts POST requests and writes attacker-supplied content into application logs without adequate input validation, allowing forged, misleading, or duplicate log entries to be injected into the audit trail. Because the assessed CVSS vector is AV:N/AC:L/PR:N/UI:N, no authentication or user interaction is required, so any remote party who can reach the exposed analytics API can abuse it - though the impact is limited to low-severity integrity loss (C:N/I:L/A:N) rather than system compromise. Exploitation status is 'no public exploit identified at time of analysis' (EPSS 0.36%, 28th percentile; not listed in CISA KEV), and practical risk depends heavily on whether the API is reachable from untrusted networks, since industrial deployments are often segmented behind OT/ICS boundaries.
An authenticated user who already possesses account-creation authorization can issue unlimited POST requests to the SICK Enterprise Analytics user-management API endpoint, generating arbitrary numbers of accounts because the service enforces no quotas, rate limiting, or validation on that operation. The result is resource exhaustion leading to degraded or denied availability, with only limited integrity impact - consistent with the assessed CVSS 4.3 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L), which explicitly excludes any confidentiality impact and requires a pre-existing privileged account. EPSS is 0.32% (23rd percentile), there is no CISA KEV entry, and no public exploit code has been identified at time of analysis, so this is a lower-tier hardening issue affecting exposed OT/ICS deployments rather than an immediately weaponizable flaw.
A information disclosure vulnerability (CVSS 7.5). High severity vulnerability requiring prompt remediation.
SICK Enterprise Analytics exposes a login-protected H2 database used for caching, and the login page renders with the username field prefilled - an unauthenticated remote attacker who can reach that interface (CVSS:3.1/AV:N/AC:L/PR:N/UI:N) can harvest a valid database username together with system/version information. The exposure is classified as CWE-497 (exposure of sensitive system information to an unauthorized control sphere) and is rated CVSS 5.3 with low confidentiality-only impact; the H2 database password is still required, so this yields reconnaissance value for follow-on credential attacks rather than direct database access. EPSS is 0.36% (28th percentile), there is no KEV listing, and no public exploit identified at time of analysis.
Unbounded logging in SICK Enterprise Analytics allows unauthenticated remote attackers to exhaust server resources by submitting oversized POST payloads to the login endpoint. When a login attempt fails, the application writes the request data to a log without validating or bounding its size (CWE-770), so repeated or very large submissions can flood logs and drive disk or memory consumption, degrading or halting the service. The flaw is network-reachable with no authentication or user interaction required (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, base 7.5), but impact is limited to availability. Exploitation status: no public exploit identified at time of analysis, and EPSS is low at 0.55% (44th percentile), consistent with a moderate-priority availability issue rather than an actively exploited one.
SICK Enterprise Analytics returns full application stack traces to authenticated users who trigger an error, disclosing internal class names, method names, and structural details of the application. The issue is rated CVSS 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) with a very low EPSS score of 0.33%, no public exploit identified at time of analysis, and no CISA KEV entry. This is a low-to-moderate priority information disclosure issue, not an urgent threat, with impact limited to confidentiality of diagnostic metadata and no integrity or availability effect.
SICK Enterprise Analytics exposes an API endpoint that accepts POST requests and writes attacker-supplied content into application logs without adequate input validation, allowing forged, misleading, or duplicate log entries to be injected into the audit trail. Because the assessed CVSS vector is AV:N/AC:L/PR:N/UI:N, no authentication or user interaction is required, so any remote party who can reach the exposed analytics API can abuse it - though the impact is limited to low-severity integrity loss (C:N/I:L/A:N) rather than system compromise. Exploitation status is 'no public exploit identified at time of analysis' (EPSS 0.36%, 28th percentile; not listed in CISA KEV), and practical risk depends heavily on whether the API is reachable from untrusted networks, since industrial deployments are often segmented behind OT/ICS boundaries.
An authenticated user who already possesses account-creation authorization can issue unlimited POST requests to the SICK Enterprise Analytics user-management API endpoint, generating arbitrary numbers of accounts because the service enforces no quotas, rate limiting, or validation on that operation. The result is resource exhaustion leading to degraded or denied availability, with only limited integrity impact - consistent with the assessed CVSS 4.3 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L), which explicitly excludes any confidentiality impact and requires a pre-existing privileged account. EPSS is 0.32% (23rd percentile), there is no CISA KEV entry, and no public exploit code has been identified at time of analysis, so this is a lower-tier hardening issue affecting exposed OT/ICS deployments rather than an immediately weaponizable flaw.
A information disclosure vulnerability (CVSS 7.5). High severity vulnerability requiring prompt remediation.