The Baggage Analytics application by SICK AG lacks sufficient controls to limit the number of failed authentication attempts within a short timeframe. This improper restriction (CWE-307) can allow attackers to conduct brute force or credential guessing attacks without being blocked or delayed by the system. The CVSS 3.1 base score is 6.5, reflecting network attack vector, low attack complexity, no privileges or user interaction required, unchanged scope, no confidentiality impact, low integrity impact, and low availability impact. No vendor patch or mitigation details are currently available, and no exploits have been observed in the wild.

An attacker can repeatedly attempt to authenticate without effective throttling or lockout mechanisms, increasing the risk of successful credential guessing. This could lead to unauthorized access or partial compromise of system integrity and availability. Confidentiality is not directly impacted according to the CVSS vector. The medium severity reflects the moderate risk posed by this vulnerability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, organizations should consider implementing compensating controls such as external rate limiting, account lockout policies, or multi-factor authentication to reduce the risk of credential guessing attacks. Monitor vendor communications for updates on patches or official mitigations.