Vulnerability · Published Jun 12, 2025 · Assigned by SICK AG
CVE-2025-49193Missing HTTP Security Headers
Medium 4.2
In plain English
A medium-severity security flaw in Baggage Analytics from SICK AG. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 24% of all known vulnerabilities).
Severity (CVSS 3.1)4.2Medium
Exploit odds (30 days)0.3%top 75.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
The application fails to implement several security headers. These headers help increase the overall security level of the web application by e.g., preventing the application to be displayed in an iFrame (Clickjacking attacks) or not executing injected malicious JavaScript code (XSS attacks).
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| SICK AG | Field Analytics | all versions |
| SICK AG | Media Server | 0 – before 1.5 |
| SICK AG | Baggage Analytics | 0 – before 4.6.3 |
| SICK AG | Tire Analytics | 0 – before 4.6.3 |
| SICK AG | Package Analytics | 0 – before 4.6.3 |
| SICK AG | Logistic Diagnostic Analytics | 0 – before 4.6.3 |
Weakness: CWE-693 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N
References
- https://sick.com/psirt x_SICK PSIRT Website
- https://cdn.sick.com/media/docs/1/11/411/Special_information_CYBERSECURITY_BY_SICK_en_IM0084411.PDF x_SICK Operating Guidelines
- https://www.cisa.gov/resources-tools/resources/ics-recommended-practices x_ICS-CERT recommended practices on Industrial Security
- https://www.first.org/cvss/calculator/3.1 x_CVSS v3.1 Calculator
- https://www.sick.com/.well-known/csaf/white/2025/sca-2025-0007.pdf vendor-advisory
- https://www.sick.com/.well-known/csaf/white/2025/sca-2025-0007.json vendor-advisory, x_csaf