API Authorization Flaw in SICK Products Enables Information Leakage and Service Disruption
CVE-2025-49181

8.6HIGH

Key Information:

Vendor

Sick Ag

Status
Sick Media Server
Vendor
CVE Published:
12 June 2025

What is CVE-2025-49181?

A significant vulnerability exists within SICK Industrial Automation Systems due to inadequate authorization checks for an API endpoint. This flaw allows unauthorized users to send HTTP GET requests to extract sensitive information. Additionally, attackers may exploit the vulnerability by sending HTTP POST requests to modify critical settings, including log file paths and service TCP ports. Such manipulation could lead to service disruptions, resulting in a Denial of Service condition. It is crucial for organizations using SICK products to review their API security measures and apply necessary updates to mitigate this risk.

Affected Version(s)

SICK Media Server all versions

References

https://sick.com/psirt
x_SICK PSIRT Website
https://cdn.sick.com/media/docs/1/11/411/Special_informat...
x_SICK Operating Guidelines
https://www.cisa.gov/resources-tools/resources/ics-recomm...
x_ICS-CERT recommended practices on Industrial Security

CVSS V3.1

Score:
8.6
Severity:
HIGH
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.
CVE-2025-49181 : API Authorization Flaw in SICK Products Enables Information Leakage and Service Disruption