What’s Vulnerable › Vulnerabilities

CVE-2025-58580: Injection via log file

• Severity: medium (CVSS 5.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-10-06 · updated 2026-10-09
• Weakness: CWE-117

Description

An API endpoint allows arbitrary log entries to be created via POST request. Without sufficient validation of the input data, an attacker can create manipulated log entries and thus falsify or dilute logs, for example.

Affected products

• SICK AG Enterprise Analytics: all versions

References

• https://sick.com/psirt
• https://www.cisa.gov/resources-tools/resources/ics-recommended-practices
• https://www.first.org/cvss/calculator/3.1
• https://www.sick.com/.well-known/csaf/white/2025/sca-2025-0010.json
• https://www.sick.com/.well-known/csaf/white/2025/sca-2025-0010.pdf
• https://www.sick.com/media/docs/9/19/719/special_information_sick_operating_guidelines_cybersecurity_by_sick_en_im0106719.pdf

Get alerted when CVE-2025-58580 or the next vulnerability affects your stack