CVE-2025-49191mediumCWE-1021

CVE-2025-49191: medium-severity vulnerability in SICK Field Analytics

Dashboards and iFrames can link malicious web content

Published

Follow this CVE+ Monitor SICK Field Analytics

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 4.8epss 0.3%
Linked URLs during the creation of iFrame widgets and dashboards are vulnerable to code execution. The URLs get embedded as iFrame widgets, making it possible to attack other users that access the dashboard by including malicious code. The attack is only possible if the attacker is authorized to create new dashboards or iFrame widgets.
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
Affected products
SICK AG · SICK Field Analytics
Related CVEs — SICK Field Analytics

In the same product, most dangerous first.

CVE-2025-49200MEDIUMUnencrypted backup contains sensitive informationEPSS 0.5%CVE-2025-49188MEDIUMSensitive Data in URLEPSS 0.4%CVE-2025-49187MEDIUMUser enumerationEPSS 0.4%CVE-2025-49190MEDIUMServer-Side Request ForgeryEPSS 0.3%CVE-2025-49199HIGHBackup files can be modified and uploadedEPSS 0.3%CVE-2025-49192MEDIUMClickjackingEPSS 0.3%