High severity · published Oct 6, 2025
CVE-2025-58584
Plain Text Transmission of Username and Password in the URL
7.5
CVSS
0.4%
EPSS
No
On KEV
Description
In the HTTP request, the username and password are transferred directly in the URL as parameters. However, URLs can be stored in various systems such as server logs, browser histories or proxy servers. As a result, there is a high risk that this sensitive data will be disclosed unintentionally.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 33% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
BA
Baggage Analytics · SICK AG
before 4.6.3 · source: vendor, NVD
EA
Enterprise Analytics · SICK AG
all versions · source: vendor, NVD
LD
Logistic Diagnostic Analytics · SICK AG
before 4.6.3 · source: vendor, NVD
PA
Package Analytics · SICK AG
before 4.6.3 · source: vendor, NVD
TA
Tire Analytics · SICK AG
before 4.6.3 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-58584
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-58584
Vendor Advisory
https://sick.com/psirt
US Government Resource
https://www.cisa.gov/resources-tools/resources/ics-recommended-practices
Not Applicable
https://www.first.org/cvss/calculator/3.1
Vendor Advisory
https://www.sick.com/.well-known/csaf/white/2025/sca-2025-0010.json
Vendor Advisory
https://www.sick.com/.well-known/csaf/white/2025/sca-2025-0010.pdf
Product
https://www.sick.com/media/docs/9/19/719/special_information_sick_operating_guidelines_cybersecurity_by_sick_en_im0106719.pdf
More from Baggage Analytics
9.8
CVE-2025-58587
Improper Restriction of Excessive Authentication Attempts
7.5
CVE-2025-58591
Path Traversal
7.5
CVE-2025-58590
Path traversal
7.5
CVE-2025-58585
Sensitive Information Disclosure Through Missing Authentication
7.5
CVE-2025-9914
The credentials of the users stored in the system's local database can be used for the log in, making it possible for an attacker to gain unauthorized access