by Kastro
Paper/Archive/CVE-2025-49182

CVE-2025-49182

SICK AG SICK Media Server — Credential disclosure

EPSS 0.6%CVSS 9.8
critical.is priorityof 100
39
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 46.2.462 × 209.2No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Files in the source code contain login credentials for the admin user and the property configuration password, allowing an attacker to get full access to the application.

Affected

ProductAffectedFixed inSource
SICK Media Server< 1.51.5CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
SICK AG (CNA)7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: partial

References

refsick.com/psirtrefcdn.sick.com/media/docs/1/11/411/Special_information_CYBERSECURITY_BY_SICK_en_IM0084411.PDFrefcisa.gov/resources-tools/resources/ics-recommended-practicesreffirst.org/cvss/calculator/3.1advisorysick.com/.well-known/csaf/white/2025/sca-2025-0007.pdfadvisorysick.com/.well-known/csaf/white/2025/sca-2025-0007.json