CVE-2025-49188VulnerabilityPublished 12 Jun 2025Updated 17 Jun 2025

CVE-2025-49188: SICK Field Analytics · Use of GET Request Method With Sensitive Query Strings

Affects SICK Field AnalyticsSource CVE Database V5

Not known to be exploited · CVSS 5.3 Medium.

Data as of 26 Oct 2026, 06:26 UTC

CVSS 3.1 base score

5.3Medium

How severe the flaw is on the 0–10 CVSS scale.

EPSS: 0.4% chance of exploitation in 30 days – higher than 37% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Attack Vector: Network
Attack Complexity: Low
Privileges Required: None
User Interaction: None
Scope: Unchanged
Confidentiality: Low
Integrity: None
Availability: None

Bold values are the worst case: easiest to exploit or largest impact.

Attack Vector: Network: The vulnerable component is bound to the network stack and the set of possible attackers extends beyond the other options listed, up to and including the entire Internet. Such a vulnerability is often termed 'remotely exploitable' and can be thought of as an attack being exploitable at the protocol level one or more network hops away (e.g., across one or more routers).
Attack Complexity: Low: Specialized access conditions or extenuating circumstances do not exist. An attacker can expect repeatable success against the vulnerable component.
Privileges Required: None: The attacker is unauthorized prior to attack, and therefore does not require any access to settings or files to carry out an attack.
User Interaction: None: The vulnerable system can be exploited without any interaction from any user.
Scope: Unchanged: An exploited vulnerability can only affect resources managed by the same security authority. In this case, the vulnerable component and the impacted component are either the same, or both are managed by the same security authority.
Confidentiality: Low: There is some loss of confidentiality. Access to some restricted information is obtained, but the attacker does not have control over what information is obtained, or the amount or kind of loss is limited. The information disclosure does not cause a direct, serious loss to the impacted component.
Integrity: None: There is no loss of integrity within the impacted component.
Availability: None: There is no impact to availability within the impacted component.

Definitions: FIRST CVSS v3.1 specification.

Exploitation evidence

Disclosed: evidence found.
CVE published 12 Jun 2025
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 2026-10-26.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponised: Public exploit code exists in Metasploit or Exploit-DB, or CISA SSVC reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

What to do

Affected software

Product	Affected	Fixed in
SICK AG SICK Field Analytics	Affected *	Fixed in–

AI-suggested

1. Immediate mitigation should focus on network-level protections such as enforcing HTTPS/TLS encryption to prevent interception of URLs containing credentials. 2. Implement network segmentation and strict access controls to limit exposure of the analytics platform to trusted networks only. 3. Monitor and audit logs and network traffic for unusual access patterns or credential leakage. 4. Encourage users to change credentials regularly and avoid credential reuse across systems to reduce impact if credentials are exposed. 5. Work with SICK AG to obtain patches or updates that correct the design flaw by moving credential transmission to POST request bodies or other secure methods. 6. If possible, deploy web application firewalls (WAFs) or intrusion detection/prevention systems (IDS/IPS) that can detect and block suspicious GET requests containing sensitive parameters. 7. Educate users and administrators about the risks of sharing URLs containing sensitive information and discourage practices such as URL sharing or bookmarking with embedded credentials. 8. Review and harden logging policies to ensure sensitive data is not stored in logs or is masked appropriately. 9. Consider implementing multi-factor authentication (MFA) on the analytics platform to reduce the impact of credential compromise. These steps go beyond generic advice by focusing on compensating controls and operational practices tailored to the specific vulnerability's nature and the industrial context of SICK Field Analytics.

Description

The application sends user credentials as URL parameters instead of POST bodies, making it vulnerable to information gathering.

Impact

For European organizations using SICK Field Analytics, this vulnerability poses a moderate risk primarily to the confidentiality of user credentials. Since the credentials are exposed in URLs, any network monitoring, logging infrastructure, or intermediaries could capture sensitive information, leading to potential unauthorized access to the analytics platform. This could result in unauthorized data exposure or manipulation of industrial analytics data, which may affect operational decision-making or industrial process monitoring. Given that SICK AG products are often deployed in industrial automation, manufacturing, and logistics sectors, compromised credentials could facilitate lateral movement within operational technology (OT) environments, increasing the risk of industrial espionage or sabotage. The vulnerability does not directly impact system integrity or availability, but the indirect consequences of credential compromise could be significant in critical infrastructure or manufacturing contexts. Additionally, the exposure of credentials may violate data protection regulations such as GDPR if personal data or user identities are involved, potentially leading to compliance issues and reputational damage. Organizations relying on SICK Field Analytics should be aware of these risks and consider them in their broader cybersecurity and risk management strategies.

Summary

CVE-2025-49188 is a medium-severity vulnerability identified in all versions of SICK AG's SICK Field Analytics product. The core issue stems from the application transmitting user credentials via URL query parameters in HTTP GET requests rather than embedding them securely within the body of POST requests. This practice violates secure coding principles and corresponds to CWE-598: Use of GET Request Method With Sensitive Query Strings. When credentials are sent as URL parameters, they become exposed in multiple places such as browser history, server logs, proxy logs, and potentially third-party monitoring tools. This exposure increases the risk of unauthorized information gathering by attackers who can intercept or access these logs. The vulnerability does not require authentication or user interaction to be exploited, and the attack vector is network-based (AV:N), meaning an attacker can remotely capture these credentials if they have network access to the communication channel. However, the impact is limited to confidentiality loss (C:L) without affecting integrity or availability. The CVSS 3.1 base score is 5.3, reflecting a medium severity level. No known exploits are currently reported in the wild, and no patches have been released yet. The vulnerability affects all versions, indicating a systemic design flaw in how the application handles sensitive data transmission. Given the nature of the flaw, attackers could perform passive reconnaissance or active interception to harvest credentials, potentially leading to unauthorized access if combined with other weaknesses or reused credentials. The lack of encryption or secure transmission mechanisms (e.g., HTTPS) would exacerbate this risk, although this detail is not specified in the provided data.

CWE-598Use of HTTP Request With Sensitive Query String (opens in a new tab)
Variant weaknessOWASP Top 10 A06:2025: Insecure Design (opens in a new tab)
The web application uses an HTTP method to process a request, but the request includes sensitive information in the query string.
Implementation
When sending sensitive information, only include it in the request body or request headers instead of the query string. This may require avoiding use of GET requests.
OWASP Cheat Sheets
Server Side Request Forgery Prevention (opens in a new tab)
Web Service Security (opens in a new tab)
Secure Design Principles (opens in a new tab)
OWASP ASVS 4.0.3
V3.1.1 (opens in a new tab)
V13.1.3 (opens in a new tab)
V8.3.4 (opens in a new tab)
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).

References

Community reviews

Loading reviews…

Exploitation evidence

What to do

Affected software

Description

AI analysisMachine-generated, updated 12 Jun 2025, 14:39 UTC

WeaknessesCWE-598

Technical details

References

Community reviews

Related threats