Login Request a demo
High severity · published Oct 6, 2025
CVE-2025-9914
The credentials of the users stored in the system's local database can be used for the log in, making it possible for an attacker to gain unauthorized access
7.5
CVSS
0.3%
EPSS
No
On KEV
Description
The credentials of the users stored in the system's local database can be used for the log in, making it possible for an attacker to gain unauthorized access. This could potentially affect the confidentiality of the application.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 26% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
BA
Baggage Analytics · SICK AG
before 4.6.3 · source: vendor, NVD
LD
Logistic Diagnostic Analytics · SICK AG
before 4.6.3 · source: vendor, NVD
PA
Package Analytics · SICK AG
before 4.6.3 · source: vendor, NVD
TA
Tire Analytics · SICK AG
before 4.6.3 · source: vendor, NVD
Affected product
BA
Baggage Analytics
SICK AG
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-9914
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-9914
Vendor Advisory
https://sick.com/psirt
US Government Resource
https://www.cisa.gov/resources-tools/resources/ics-recommended-practices
Not Applicable
https://www.first.org/cvss/calculator/3.1
Vendor Advisory
https://www.sick.com/.well-known/csaf/white/2025/sca-2025-0010.json
Vendor Advisory
https://www.sick.com/.well-known/csaf/white/2025/sca-2025-0010.pdf
Product
https://www.sick.com/media/docs/9/19/719/special_information_sick_operating_guidelines_cybersecurity_by_sick_en_im0106719.pdf
More from Baggage Analytics
9.8
CVE-2025-58587
Improper Restriction of Excessive Authentication Attempts
7.5
CVE-2025-58591
Path Traversal
7.5
CVE-2025-58590
Path traversal
7.5
CVE-2025-58585
Sensitive Information Disclosure Through Missing Authentication
7.5
CVE-2025-58584
Plain Text Transmission of Username and Password in the URL