7.5High
CVE-2025-49183Unencrypted communication (HTTP)
Description
All communication with the REST API is unencrypted (HTTP), allowing an attacker to intercept traffic between an actor and the webserver. This leads to the possibility of information gathering and downloading media files.
Weakness (CWE):
CWE-319
Data: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Published as the sources state it, in English.
Affected products and versions
| Vendor | Product | Versions | |
|---|---|---|---|
| sick | media server | — | |
| SICK AG | SICK Media Server | all versions |
References and patches
- https://sick.com/psirt Vendor Advisory
- https://cdn.sick.com/media/docs/1/11/411/Special_information_CYBERSECURITY_BY_SICK_en_IM0084411.PDF Broken Link
- https://www.cisa.gov/resources-tools/resources/ics-recommended-practices US Government Resource
- https://www.first.org/cvss/calculator/3.1 Not Applicable
- https://www.sick.com/.well-known/csaf/white/2025/sca-2025-0007.pdf vendor-advisoryVendor Advisory
- https://www.sick.com/.well-known/csaf/white/2025/sca-2025-0007.json vendor-advisoryVendor Advisory
CPE matches (NVD) (1)
cpe:2.3:a:sick:media_server:*:*:*:*:*:*:*:*