CVE-2025-49191

MEDIUM

Sick Field Analytics - Code Execution via iFrame Widget URLs

Title source: llm

Description

Linked URLs during the creation of iFrame widgets and dashboards are vulnerable to code execution. The URLs get embedded as iFrame widgets, making it possible to attack other users that access the dashboard by including malicious code. The attack is only possible if the attacker is authorized to create new dashboards or iFrame widgets.

References (6)

[Vendor Advisory] https://sick.com/psirt

[Broken Link] https://cdn.sick.com/media/docs/1/11/411/Special_information_CYBERSECURITY_BY_SICK_en_IM0084411.PDF

[US Government Resource] https://www.cisa.gov/resources-tools/resources/ics-recommended-practices

[Not Applicable] https://www.first.org/cvss/calculator/3.1

[Vendor Advisory] https://www.sick.com/.well-known/csaf/white/2025/sca-2025-0007.pdf

[Vendor Advisory] https://www.sick.com/.well-known/csaf/white/2025/sca-2025-0007.json

Scores

CVSS v3 4.8

EPSS 0.0020

EPSS Percentile 41.4%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact partial

Details

CWE

CWE-1021

Status published

Products (1)

sick/field_analytics

Published Jun 12, 2025

Tracked Since Feb 18, 2026