This vulnerability involves an observable response discrepancy (CWE-204) in the login mechanism of SICK AG's Baggage Analytics. When a login attempt fails, the system reveals whether the failure was due to a non-existent username or an incorrect password by returning different error messages. This behavior enables attackers to perform username enumeration attacks, potentially aiding further targeted attacks. The CVSS 3.1 base score is 5.3 (medium severity), reflecting that the attack vector is network-based, requires no privileges or user interaction, and impacts confidentiality with limited scope.

The primary impact is information disclosure through username enumeration. Attackers can identify valid usernames, which may facilitate subsequent attacks such as password guessing or social engineering. There is no direct impact on system integrity or availability reported.

No patch or official fix is currently available for this vulnerability. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. As a mitigation, it is recommended to standardize error messages for failed login attempts so that they do not reveal whether the username or password was incorrect, thereby preventing username enumeration.