CVE-2025-58580CWE-117

CVE-2025-58580

Medium · published October 6, 2025

CVSS v3.1
6.5
EPSS
0%
Percentile
29.2
In the wild
Unconfirmed
What it is

An API endpoint allows arbitrary log entries to be created via POST request. Without sufficient validation of the input data, an attacker can create manipulated log entries and thus falsify or dilute logs, for example.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.00365 · 29.2th percentile
Weakness
CWE-117 · Improper Output Neutralization for Logs
Published
2025-10-06T11:15Z
Affected products (1)
ProductVersionsFixed in
sick/enterprise_analyticsall versions—
References (6)
https://sick.com/psirt · [email protected]https://www.cisa.gov/resources-tools/resources/ics-recommended-practices · [email protected]https://www.first.org/cvss/calculator/3.1 · [email protected]https://www.sick.com/.well-known/csaf/white/2025/sca-2025-0010.json · [email protected]https://www.sick.com/.well-known/csaf/white/2025/sca-2025-0010.pdf · [email protected]https://www.sick.com/media/docs/9/19/719/special_information_sick_operating_guidelines_cybersecurity_by_sick_en_im0106719.pdf · [email protected]
EPSS history
Timeline
  • 06 OCT 06:49Z
    Injection via log file
    cvelistv5