5.3Medium
CVE-2025-58586User Enumeration by excessive error output
Description
For failed login attempts, the application returns different error messages depending on whether the login failed due to an incorrect password or a non-existing username. This allows an attacker to guess usernames until they find an existing one.
Weakness (CWE):
CWE-204
Data: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Published as the sources state it, in English.
Affected products and versions
| Vendor | Product | Versions | |
|---|---|---|---|
| SICK AG | Baggage Analytics | < 4.6.3 | |
| SICK AG | Enterprise Analytics | all versions | |
| SICK AG | Logistic Diagnostic Analytics | < 4.6.3 | |
| SICK AG | Package Analytics | < 4.6.3 | |
| SICK AG | Tire Analytics | < 4.6.3 |
References and patches
- https://sick.com/psirt Vendor Advisory
- https://www.sick.com/media/docs/9/19/719/special_information_sick_operating_guidelines_cybersecurity_by_sick_… Product
- https://www.cisa.gov/resources-tools/resources/ics-recommended-practices US Government Resource
- https://www.first.org/cvss/calculator/3.1 Not Applicable
- https://www.sick.com/.well-known/csaf/white/2025/sca-2025-0010.json Vendor Advisory
- https://www.sick.com/.well-known/csaf/white/2025/sca-2025-0010.pdf vendor-advisoryVendor Advisory
CPE matches (NVD) (5)
cpe:2.3:a:sick:baggage_analytics:*:*:*:*:*:*:*:*cpe:2.3:a:sick:enterprise_analytics:*:*:*:*:*:*:*:*cpe:2.3:a:sick:logistic_diagnostic_analytics:*:*:*:*:*:*:*:*cpe:2.3:a:sick:package_analytics:*:*:*:*:*:*:*:*cpe:2.3:a:sick:tire_analytics:*:*:*:*:*:*:*:*