Read the docs
TI-2020-01966 Aliases CVE-2020-2078GHSA-5p7r-6jmj-6mcv

Insufficiently protected credentials in SICK Package Analytics

Priority LOW 30CWE-522Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-522.

Summary

Passwords are stored in plain text within the configuration of SICK Package Analytics software up to and including V04.1.1. An authorized attacker could access these stored plaintext credentials and gain access to the ftp service. Storing a password in plaintext allows attackers to easily gain access to systems, potentially compromising personal information or other sensitive information.

Why it matters now

EPSS 0.00752 55th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
—SICK Package Analyticsup to V04.1.1—No fix listedCNA
  • SICK Package Analytics Vendor— Affected up to V04.1.1 Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:sick:package_analytics:*:*:*:*:*:*:*:*up to 04.1.1VulnerableSICK AG
  • cpe:2.3:a:sick:package_analytics:*:*:*:*:*:*:*:* Versions up to 04.1.1 Vulnerable ·SICK AG

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2020-2078
  2. 2026-10-03 Alias added: GHSA-5p7r-6jmj-6mcv

References

Advisory 1

  • TI-2025-36256 Improper Restriction of Excessive Authentication Attempts CVSS 3.1CRITICAL 9.8
  • TI-2020-01964 Missing authentication in SICK Package Analytics CVSS 3.1CRITICAL 9.8
  • TI-2025-36254 Sensitive information disclosure through missing authentication in SICK AG Baggage… CVSS 3.1HIGH 7.5
  • TI-2025-36253 Plain Text Transmission of Username and Password in the URL CVSS 3.1HIGH 7.5
  • TI-2025-31251 Information disclosure to unauthorized user CVSS 3.1HIGH 7.5
  • TI-2025-31253 No brute-force protection CVSS 3.1MEDIUM 6.5
See all 15 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences