API Authorization Flaw in SICK Products Enables Information Leakage and Service Disruption

CVE-2025-49181

What is CVE-2025-49181?

A significant vulnerability exists within SICK Industrial Automation Systems due to inadequate authorization checks for an API endpoint. This flaw allows unauthorized users to send HTTP GET requests to extract sensitive information. Additionally, attackers may exploit the vulnerability by sending HTTP POST requests to modify critical settings, including log file paths and service TCP ports. Such manipulation could lead to service disruptions, resulting in a Denial of Service condition. It is crucial for organizations using SICK products to review their API security measures and apply necessary updates to mitigate this risk.

References