SICK AG Enterprise Analytics vulnerabilities
🔔 Create alert RSS Version checker
Published CVEs affecting SICK AG Enterprise Analytics: 5 record(s), with affected versions and fixes.cpe:2.3:a:sick:enterprise_analytics
CVE-2025-58583
Medium · 5.3
CWE-497 Oct 6, 2025
User Enumeration
The application provides access to a login protected H2 database for caching purposes. The username is prefilled.
CVE-2025-58582
High · 7.5
CWE-770 Oct 6, 2025
Uncontrolled Resource Consumption via log file
If a user tries to login but the provided credentials are incorrect a log is created. The data for this POST requests is not validated and it’s possible to send giant payloads which are then logged.
CVE-2025-58581
Medium · 4.3
CWE-200 Oct 6, 2025
Information Disclosure Through Stacktrace-/MQTT/Config/changeAll
When an error occurs in the application a full stacktrace is provided to the user. The stacktrace lists class and method names as well as other internal information. An attacker can thus obtain information about the technology used and the structure of the application.
CVE-2025-58580
Medium · 5.3
CWE-117 Oct 6, 2025
Injection via log file
An API endpoint allows arbitrary log entries to be created via POST request. Without sufficient validation of the input data, an attacker can create manipulated log entries and thus falsify or dilute logs, for example.
CVE-2025-58578
Medium · 4.3
CWE-770 Oct 6, 2025
Unlimited user creation by authorized users
A user with the appropriate authorization can create any number of user accounts via an API endpoint using a POST request. There are no quotas, checking mechanisms or restrictions to limit the creation.