This vulnerability involves the transmission of sensitive authentication data (username and password) directly within the URL query string of HTTP GET requests in SICK AG's Baggage Analytics product. URLs containing these credentials may be stored in server logs, browser history, or proxy caches, increasing the risk of credential exposure. The CVSS v3.1 base score is 5.3 (medium severity), reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and limited confidentiality impact. No patch or vendor advisory detailing remediation is currently available, and the product is not a cloud service, so remediation responsibility lies with the user/vendor.

The primary impact is the potential unintended disclosure of sensitive authentication credentials due to their inclusion in URLs. This could lead to credential compromise if logs or caches are accessed by unauthorized parties. The vulnerability does not directly affect system integrity or availability and has no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should avoid transmitting sensitive credentials in URL query strings. Alternative methods such as POST requests with encrypted payloads or other secure authentication mechanisms should be used to protect sensitive data.