What’s Vulnerable › Vulnerabilities

CVE-2025-49193: Missing HTTP Security Headers

• Severity: medium (CVSS 6.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-06-12 · updated 2026-06-17
• Weakness: CWE-693

Description

The application fails to implement several security headers. These headers help increase the overall security level of the web application by e.g., preventing the application to be displayed in an iFrame (Clickjacking attacks) or not executing injected malicious JavaScript code (XSS attacks).

Affected products

• SICK AG Baggage Analytics: all versions
• SICK AG SICK Field Analytics: all versions
• SICK AG Logistic Diagnostic Analytics: all versions
• SICK AG SICK Media Server: before 1.5 — fixed in 1.5
• SICK AG Package Analytics: all versions
• SICK AG Tire Analytics: all versions

How to fix

Upgrade to a fixed version: SICK AG SICK Media Server 1.5. Check the vendor advisory for mitigations.

References

• https://cdn.sick.com/media/docs/1/11/411/Special_information_CYBERSECURITY_BY_SICK_en_IM0084411.PDF
• https://sick.com/psirt
• https://www.cisa.gov/resources-tools/resources/ics-recommended-practices
• https://www.first.org/cvss/calculator/3.1
• https://www.sick.com/.well-known/csaf/white/2025/sca-2025-0007.json
• https://www.sick.com/.well-known/csaf/white/2025/sca-2025-0007.pdf

Get alerted when CVE-2025-49193 or the next vulnerability affects your stack