Read the docs
TI-2025-31249 Aliases CVE-2025-49182GHSA-mjh6-vpjc-86w5

Credential disclosure

Priority MEDIUM 49CWE-540Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA.

Summary

Files in the source code contain login credentials for the admin user and the property configuration password, allowing an attacker to get full access to the application.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00553 46th percentileScored 2026-11-07
Fix Fixed SICK Media Server (SICK AG): 1.5

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
SICK AGSICK Media Serverbefore 1.51.5Patch availableCNA
  • SICK Media Server VendorSICK AG Affected before 1.5 Fixed in 1.5 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:sick:media_server:*:*:*:*:*:*:*:*before 1.5VulnerableSICK AG
  • cpe:2.3:a:sick:media_server:*:*:*:*:*:*:*:* Versions before 1.5 Vulnerable ·SICK AG

Remediation

  • Fix · CNA SICK Media Server (SICK AG) Fixed in 1.5

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Advisory ·

    SICK Media Server — sick.com/.well-known/csaf/white/2025/sca-2025-0007.json

    9 records Highest priority Priority MEDIUM 3 MEDIUM, 6 LOW

    Other records, highest priority first

    • TI-2025-31262 No protection against brute-force attacksPriority MEDIUM 49
    • TI-2025-31248 Configurations endpoint does not require authorizationPriority MEDIUM 43
    • TI-2025-31261 Unencrypted communicationPriority LOW 39
    Show all 9 records → Advisory →
  • Advisory ·

    SICK Media Server — sick.com/.well-known/csaf/white/2025/sca-2025-0007.pdf

    9 records Highest priority Priority MEDIUM 3 MEDIUM, 6 LOW

    Other records, highest priority first

    • TI-2025-31262 No protection against brute-force attacksPriority MEDIUM 49
    • TI-2025-31248 Configurations endpoint does not require authorizationPriority MEDIUM 43
    • TI-2025-31261 Unencrypted communicationPriority LOW 39
    Show all 9 records → Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-49182
  2. 2026-10-03 Alias added: GHSA-mjh6-vpjc-86w5

References

Advisory 3

Other 3

  • TI-2025-31262 No protection against brute-force attacks CVSS 3.1CRITICAL 9.8
  • TI-2025-31248 Configurations endpoint does not require authorization CVSS 3.1HIGH 8.6
  • TI-2025-31261 Unencrypted communication CVSS 3.1HIGH 7.5
  • TI-2025-31250 Unencrypted communication (HTTP) CVSS 3.1HIGH 7.5
  • TI-2025-31265 Poor quality of randomness in authorization tokens CVSS 3.1HIGH 7.5
  • TI-2025-31264 Deprecated TLS version supported CVSS 3.1HIGH 7.5
See all 9 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences