High severity · published Jun 12, 2025
CVE-2025-49183
Unencrypted communication (HTTP)
7.5
CVSS
0.3%
EPSS
No
On KEV
Description
All communication with the REST API is unencrypted (HTTP), allowing an attacker to intercept traffic between an actor and the webserver. This leads to the possibility of information gathering and downloading media files.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 24% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SM
SICK Media Server · SICK AG
all versions · source: vendor
MS
Media Server · Sick
All versions, or not specified · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-49183
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-49183
Broken Link
https://cdn.sick.com/media/docs/1/11/411/Special_information_CYBERSECURITY_BY_SICK_en_IM0084411.PDF
Vendor Advisory
https://sick.com/psirt
US Government Resource
https://www.cisa.gov/resources-tools/resources/ics-recommended-practices
Not Applicable
https://www.first.org/cvss/calculator/3.1
Vendor Advisory
https://www.sick.com/.well-known/csaf/white/2025/sca-2025-0007.json
Vendor Advisory
https://www.sick.com/.well-known/csaf/white/2025/sca-2025-0007.pdf
More from SICK Media Server
9.8
CVE-2025-49195
No protection against brute-force attacks
9.8
CVE-2025-49182
Credential disclosure
8.6
CVE-2025-49181
Configurations endpoint does not require authorization
7.5
CVE-2025-49198
Poor quality of randomness in authorization tokens
7.5
CVE-2025-49197
Deprecated TLS version supported