CVE-2025-58591 Details
Description
A remote, unauthorized attacker can brute force folders and files and read them like private keys or configurations, making the application vulnerable for gathering sensitive information.
A path traversal vulnerability has been identified in multiple SICK analytics products, including SICK Enterprise Analytics and various SICK Logistic Analytics solutions. This vulnerability allows remote, unauthorized attackers to brute-force directories and files, accessing sensitive information such as private keys and configuration files. The issue arises from inadequate authorization on endpoints that expose sensitive data, creating a risk of unauthorized information disclosure.
Users are advised to update to the latest version of SICK Baggage Analytics, SICK Logistic Diagnostic Analytics, SICK Package Analytics, or SICK Tire Analytics. For other affected products, ensure that only trusted entities have access to the device and follow general security practices as outlined in the SICK Operating Guidelines and ICS-CERT recommended practices on Industrial Security.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Oct 6, 2025References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-22 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| sick baggage analytics | All versions |
CPE
Remediation
| |
| sick logistic diagnostic analytics | All versions |
CPE
Remediation
| |
| sick package analytics | All versions |
CPE
Remediation
| |
| sick tire analytics | All versions |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jan 27, 2026 | Initial Analysis | [email protected] |
| Oct 6, 2025 | New CVE Received | [email protected] |