4.8Medium
CVE-2025-49191Dashboards and iFrames can link malicious web content
Description
Linked URLs during the creation of iFrame widgets and dashboards are vulnerable to code execution. The URLs get embedded as iFrame widgets, making it possible to attack other users that access the dashboard by including malicious code. The attack is only possible if the attacker is authorized to create new dashboards or iFrame widgets.
Weakness (CWE):
CWE-1021
Data: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Published as the sources state it, in English.
Affected products and versions
| Vendor | Product | Versions | |
|---|---|---|---|
| sick | field analytics | — | |
| SICK AG | SICK Field Analytics | all versions |
References and patches
- https://sick.com/psirt Vendor Advisory
- https://cdn.sick.com/media/docs/1/11/411/Special_information_CYBERSECURITY_BY_SICK_en_IM0084411.PDF Broken Link
- https://www.cisa.gov/resources-tools/resources/ics-recommended-practices US Government Resource
- https://www.first.org/cvss/calculator/3.1 Not Applicable
- https://www.sick.com/.well-known/csaf/white/2025/sca-2025-0007.pdf vendor-advisoryVendor Advisory
- https://www.sick.com/.well-known/csaf/white/2025/sca-2025-0007.json vendor-advisoryVendor Advisory
CPE matches (NVD) (1)
cpe:2.3:a:sick:field_analytics:*:*:*:*:*:*:*:*