CVE-2025-58584CWE-598

CVE-2025-58584

Medium · published October 6, 2025

CVSS v3.1

5.3

EPSS

Percentile

31.8

In the wild

Unconfirmed

What it is

In the HTTP request, the username and password are transferred directly in the URL as parameters. However, URLs can be stored in various systems such as server logs, browser histories or proxy servers. As a result, there is a high risk that this sensitive data will be disclosed unintentionally.

The record

Technical detail

CVSS v3.1: 5.3 · MEDIUM
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0: Not supplied
EPSS: 0.00389 · 31.8th percentile
Weakness: CWE-598 · Use of HTTP Request With Sensitive Query String
Published: 2025-10-06T11:15Z

Affected products (5)

Product	Versions	Fixed in
sick/baggage_analytics	all versions	—
sick/enterprise_analytics	all versions	—
sick/logistic_diagnostic_analytics	all versions	—
sick/package_analytics	all versions	—
sick/tire_analytics	all versions	—

References (6)

https://sick.com/psirt · [email protected]https://www.cisa.gov/resources-tools/resources/ics-recommended-practices · [email protected]https://www.first.org/cvss/calculator/3.1 · [email protected]https://www.sick.com/.well-known/csaf/white/2025/sca-2025-0010.json · [email protected]https://www.sick.com/.well-known/csaf/white/2025/sca-2025-0010.pdf · [email protected]https://www.sick.com/media/docs/9/19/719/special_information_sick_operating_guidelines_cybersecurity_by_sick_en_im0106719.pdf · [email protected]

EPSS history

Timeline

06 OCT 07:01Z
Plain Text Transmission of Username and Password in the URL
cvelistv5