Vulnerability details

CVE-2025-49199

SICK Field Analytics

Backup files can be modified and uploaded

CVSS 3.1

8.8High

Official description

The backup ZIPs are not signed by the application, leading to the possibility that an attacker can download a backup ZIP, modify and re-upload it. This allows the attacker to disrupt the application by configuring the services in a way that they are unable to run, making the application unusable. They can redirect traffic that is meant to be internal to their own hosted services and gathering information.

CVSS scores

Score	Version	Source	Vector
8.8High	3.1	CVEProject cvelistV5 (CNA) (SICK AG)	`CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H`

Affected products

Vendor	Product	Versions	Source
SICK AG	SICK Field Analytics	all versions	CVEProject cvelistV5 (CNA)

References and advisories

https://sick.com/psirt x_SICK PSIRT Website
https://cdn.sick.com/media/docs/1/11/411/Special_information_CYBERSECURITY_BY_SICK_en_IM0084411.PDF x_SICK Operating Guidelines
https://www.cisa.gov/resources-tools/resources/ics-recommended-practices x_ICS-CERT recommended practices on Industrial Security
https://www.first.org/cvss/calculator/3.1 x_CVSS v3.1 Calculator
https://www.sick.com/.well-known/csaf/white/2025/sca-2025-0007.pdf vendor-advisory
https://www.sick.com/.well-known/csaf/white/2025/sca-2025-0007.json vendor-advisoryx_csaf

Kolun on Telegram @kolunsec Exploited CVEs, key news and a daily digest Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.

Details

Published: 2025-06-12
Last updated: 2025-06-17
State: Published
Assigner (CNA): SICK AG

Exploit prediction (EPSS)

0.34%

Probability of exploitation in 30 days

27.8%

Percentile (among all CVEs)

SSVC assessment (CISA)

Automatable: No
Exploitation: None
Technical impact: Partial

Weaknesses (CWE)

CWE-345
Insufficient Verification of Data Authenticity