Session Hijacking Risk in SICK's Dashboard Feature
CVE-2025-9913

4.5MEDIUM

Key Information:

Vendor

Sick Ag

Status
Baggage Analytics
Tire Analytics
Package Analytics
Logistic Diagnostic Analytics
Vendor
CVE Published:
6 October 2025

What is CVE-2025-9913?

A vulnerability in the SICK Dashboard allows JavaScript code execution via the 'Open in new Tab' button. This flaw can enable attackers to hijack user sessions, potentially compromising sensitive information and application integrity. Users are advised to review configurations and implement security measures to mitigate risks associated with this issue.

Affected Version(s)

Baggage Analytics all versions

Logistic Diagnostic Analytics all versions

Package Analytics all versions

References

https://sick.com/psirt
x_SICK PSIRT Security Advisories
https://www.sick.com/media/docs/9/19/719/special_informat...
x_SICK Operating Guidelines
https://www.cisa.gov/resources-tools/resources/ics-recomm...
x_ICS-CERT recommended practices on Industrial Security

CVSS V3.1

Score:
4.5
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.