CVE-2025-9914 Auth bypass in Baggage Analytics

Medium 4.3 Published 6 Oct 2025 Updated 13 May 2026

Attackers can bypass authentication using local database credentials to gain unauthorized access and compromise data confidentiality in SICK analytics applications.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2025-9914?

CVE-2025-9914 is a medium-severity authentication bypass vulnerability in SICK AG Baggage Analytics, published on 6 Oct 2025. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

The credentials of the users stored in the system's local database can be used for the log in, making it possible for an attacker to gain unauthorized access. This could potentially affect the confidentiality of the application.

Weakness: CWE-288

Which versions are affected by CVE-2025-9914?

It affects 4 products.

Products include Sick Baggage Analytics, Sick Logistic Diagnostic Analytics, Sick Package Analytics, Sick Tire Analytics.

How do I fix CVE-2025-9914?

No fix has been published for CVE-2025-9914 yet. Limit exposure of the affected software until one is available.

Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.

Is CVE-2025-9914 being exploited?

There is no known exploitation of CVE-2025-9914 in the wild and no public exploit code.

Sources

Also known as GHSA-vc38-c3pm-pr72.