CVE-2025-49184 Information disclosure to unauthorized user

What is CVE-2025-49184?

CVE-2025-49184 is a high-severity missing authorization vulnerability in SICK AG Baggage Analytics, published on 12 Jun 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

A remote unauthorized attacker may gather sensitive information of the application, due to missing authorization of configuration settings of the product.

Weakness: CWE-200

Which versions are affected by CVE-2025-49184?

It affects 6 products.

Products include Sick Baggage Analytics, Sick Enterprise Analytics, Sick Field Analytics, Sick Logistic Diagnostic Analytics, Sick Package Analytics, Sick Tire Analytics.

How do I fix CVE-2025-49184?

No fix has been published for CVE-2025-49184 yet. Limit exposure of the affected software until one is available.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2025-49184 being exploited?

There is no known exploitation of CVE-2025-49184 in the wild and no public exploit code.

Other vulnerabilities in SICK AG Baggage Analytics

• CVE-2025-58587 Improper Restriction of Excessive Authentication Attempts Medium 6.5
• CVE-2025-58590 Path traversal Medium 6.5
• CVE-2025-58591 Path Traversal Medium 6.5
• CVE-2025-58579 Username Disclosure Through Missing Authentication Medium 5.3
• CVE-2025-58584 Plain Text Transmission of Username and Password in the URL Medium 5.3

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-w75x-76gf-r6p7.