Read the docs
TI-2025-36254 Aliases CVE-2025-58585GHSA-654c-35qv-mg5r

Sensitive information disclosure through missing authentication in SICK AG Baggage…

Priority LOW 39CWE-497Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-497.

Summary

Multiple endpoints with sensitive information do not require authentication, making the application susceptible to information gathering.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00425 37th percentileScored 2026-11-07
Fix Fixed Baggage Analytics (SICK AG): 4.6.3Tire Analytics (SICK AG): 4.6.3+2 more products

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
SICK AGBaggage Analyticsbefore 4.6.34.6.3Patch availableCNA
SICK AGTire Analyticsbefore 4.6.34.6.3Patch availableCNA
SICK AGPackage Analyticsbefore 4.6.34.6.3Patch availableCNA
SICK AGLogistic Diagnostic Analyticsbefore 4.6.34.6.3Patch availableCNA
  • Baggage Analytics VendorSICK AG Affected before 4.6.3 Fixed in 4.6.3 Patch available CNA
  • Tire Analytics VendorSICK AG Affected before 4.6.3 Fixed in 4.6.3 Patch available CNA
  • Package Analytics VendorSICK AG Affected before 4.6.3 Fixed in 4.6.3 Patch available CNA
  • Logistic Diagnostic Analytics VendorSICK AG Affected before 4.6.3 Fixed in 4.6.3 Patch available CNA

CPE configurations NVD · 4

CPEVersionsRoleVendor
cpe:2.3:a:sick:baggage_analytics:*:*:*:*:*:*:*:*all versionsVulnerableSICK AG
cpe:2.3:a:sick:logistic_diagnostic_analytics:*:*:*:*:*:*:*:*all versionsVulnerableSICK AG
cpe:2.3:a:sick:package_analytics:*:*:*:*:*:*:*:*all versionsVulnerableSICK AG
cpe:2.3:a:sick:tire_analytics:*:*:*:*:*:*:*:*all versionsVulnerableSICK AG
  • cpe:2.3:a:sick:baggage_analytics:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·SICK AG
  • cpe:2.3:a:sick:logistic_diagnostic_analytics:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·SICK AG
  • cpe:2.3:a:sick:package_analytics:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·SICK AG
  • cpe:2.3:a:sick:tire_analytics:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·SICK AG

Remediation

  • Fix · CNA Baggage Analytics (SICK AG) Fixed in 4.6.3
  • Fix · CNA Tire Analytics (SICK AG) Fixed in 4.6.3
  • Fix · CNA Package Analytics (SICK AG) Fixed in 4.6.3
  • Fix · CNA Logistic Diagnostic Analytics (SICK AG) Fixed in 4.6.3

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Advisory ·

    SICK Baggage Analytics, Logistic Diagnostic Analytics and 2 more products — sick.com/.well-known/csaf/white/2025/sca-2025-0010.pdf

    10 records Highest priority Priority MEDIUM 1 MEDIUM, 9 LOW

    Other records, highest priority first

    • TI-2025-36256 Improper Restriction of Excessive Authentication AttemptsPriority MEDIUM 49
    • TI-2025-36253 Plain Text Transmission of Username and Password in the URLPriority LOW 39
    • TI-2025-36259 Path traversal in SICK AG Baggage AnalyticsPriority LOW 34
    Show all 10 records → Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-58585
  2. 2026-10-03 Alias added: GHSA-654c-35qv-mg5r

References

Advisory 3

Other 3

  • TI-2025-36256 Improper Restriction of Excessive Authentication Attempts CVSS 3.1CRITICAL 9.8
  • TI-2025-36253 Plain Text Transmission of Username and Password in the URL CVSS 3.1HIGH 7.5
  • TI-2025-31251 Information disclosure to unauthorized user CVSS 3.1HIGH 7.5
  • TI-2025-31253 No brute-force protection CVSS 3.1MEDIUM 6.5
  • TI-2025-36259 Path traversal in SICK AG Baggage Analytics CVSS 3.1HIGH 7.5
  • TI-2025-36258 Path traversal in SICK AG Baggage Analytics CVSS 3.1HIGH 7.5
See all 12 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences