Vulnerability details

CVE-2025-59460

SICK TLOC100-100 with Firmware <

Unsecure access configuration

CVSS 3.1

7.5High

Official description

The system is deployed in its default state, with configuration settings that do not comply with the latest best practices for restricting access. This increases the risk of unauthorised connections.

CVSS scores

Score	Version	Source	Vector
7.5High	3.1	CVEProject cvelistV5 (CNA) (SICK AG)	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N`

Affected products

Vendor	Product	Versions	Source
SICK AG	TLOC100-100 with Firmware <7.1.1	v < <7.1.1	CVEProject cvelistV5 (CNA)

References and advisories

https://sick.com/psirt x_SICK PSIRT Security Advisories
https://www.sick.com/media/docs/9/19/719/special_information_sick_operating_guidelines_cybersecurity_by_sick_en_im0106719.pdf x_SICK Operating Guidelines
https://www.cisa.gov/resources-tools/resources/ics-recommended-practices x_ICS-CERT recommended practices on Industrial Security
https://www.first.org/cvss/calculator/3.1 x_CVSS v3.1 Calculator
https://www.sick.com/.well-known/csaf/white/2025/sca-2025-0013.json x_The canonical URL.
https://www.sick.com/.well-known/csaf/white/2025/sca-2025-0013.pdf vendor-advisory

Kolun on Telegram @kolunsec Exploited CVEs, key news and a daily digest Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.

Details

Published: 2025-10-27
Last updated: 2025-10-27
State: Published
Assigner (CNA): SICK AG

Exploit prediction (EPSS)

0.43%

Probability of exploitation in 30 days

37.6%

Percentile (among all CVEs)

SSVC assessment (CISA)

Automatable: Yes
Exploitation: None
Technical impact: Partial

Weaknesses (CWE)

CWE-1391
Use of Weak Credentials