CVE-2025-58584mediumCWE-598

CVE-2025-58584: medium-severity vulnerability in SICK AG Baggage Analytics

Plain Text Transmission of Username and Password in the URL

Published · Updated

Follow this CVE+ Monitor Package Analytics+ Monitor Baggage Analytics

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 5.3epss 0.4%
In the HTTP request, the username and password are transferred directly in the URL as parameters. However, URLs can be stored in various systems such as server logs, browser histories or proxy servers. As a result, there is a high risk that this sensitive data will be disclosed unintentionally.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Affected products
SICK AG · Baggage AnalyticsSICK AG · Enterprise AnalyticsSICK AG · Logistic Diagnostic AnalyticsSICK AG · Package AnalyticsSICK AG · Tire Analytics
Related CVEs — SICK AG Baggage Analytics

In the same product, most dangerous first.

CVE-2025-58582MEDIUMUncontrolled Resource Consumption via log fileEPSS 0.6%CVE-2025-58591MEDIUMPath TraversalEPSS 0.5%CVE-2025-58590MEDIUMPath traversalEPSS 0.5%CVE-2025-49184HIGHInformation disclosure to unauthorized userEPSS 0.5%CVE-2025-58587MEDIUMImproper Restriction of Excessive Authentication AttemptsEPSS 0.5%CVE-2025-58585MEDIUMSensitive Information Disclosure Through Missing AuthenticationEPSS 0.4%