Description
In the HTTP request, the username and password are transferred directly in the URL as parameters. However, URLs can be stored in various systems such as server logs, browser histories or proxy servers. As a result, there is a high risk that this sensitive data will be disclosed unintentionally.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
SICK AG Baggage Analytics
Default version status: affected
0 to < 4.6.3affected
SICK AG Tire Analytics
Default version status: affected
0 to < 4.6.3affected
SICK AG Package Analytics
Default version status: affected
0 to < 4.6.3affected
SICK AG Logistic Diagnostic Analytics
Default version status: affected
0 to < 4.6.3affected
SICK AG Enterprise Analytics
Default version status: affected
all versionsaffected
References
- https://sick.com/psirt ↗
- https://www.sick.com/media/docs/9/19/719/special_information_sick_operating_guidelines_cybersecurity_by_sick_en_im0106719.pdf ↗
- https://www.cisa.gov/resources-tools/resources/ics-recommended-practices ↗
- https://www.first.org/cvss/calculator/3.1 ↗
- https://www.sick.com/.well-known/csaf/white/2025/sca-2025-0010.json ↗
- https://www.sick.com/.well-known/csaf/white/2025/sca-2025-0010.pdf ↗