API does not require authentication
Summary
| CVE | CVE-2025-59461 |
|---|---|
| State | PUBLISHED |
| Assigner | SICK AG |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2025-10-27 11:15:40 UTC |
| Updated | 2026-10-08 11:10:00 UTC |
| Description | A remote unauthenticated attacker may use the unauthenticated C++ API to access or modify sensitive data and disrupt services. |
Risk And Classification
Primary CVSS: v3.1 9.8 CRITICAL from [email protected]
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Problem Types: CWE-862 | CWE-862 CWE-862 Missing Authorization
| Version | Source | Type | Score | Severity | Vector |
|---|---|---|---|---|---|
| 3.1 | [email protected] | Primary | 9.8 | CRITICAL | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| 3.1 | [email protected] | Secondary | 7.6 | HIGH | CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H |
| 3.1 | CNA | CVSS | 7.6 | HIGH | CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H |
CVSS v3.1 Breakdown
Attack Vector
NetworkAttack Complexity
LowPrivileges Required
NoneUser Interaction
NoneScope
UnchangedConfidentiality
HighIntegrity
HighAvailability
HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Hardware | Sick | Tloc100-100 | - | All | All | All |
| Operating System | Sick | Tloc100-100 Firmware | All | All | All | All |
Vendor Declared Affected Products
| Source | Vendor | Product | Version | Platforms |
|---|---|---|---|---|
| CNA | SICK AG | TLOC100-100 All Firmware Versions | affected all versions custom | Not specified |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| www.sick.com/.well-known/csaf/white/2025/sca-2025-0013.json | [email protected] | www.sick.com | Vendor Advisory |
| www.first.org/cvss/calculator/3.1 | [email protected] | www.first.org | Not Applicable |
| sick.com/psirt | [email protected] | sick.com | Vendor Advisory |
| www.sick.com/.well-known/csaf/white/2025/sca-2025-0013.pdf | [email protected] | www.sick.com | Vendor Advisory |
| www.cisa.gov/resources-tools/resources/ics-recommended-practices | [email protected] | www.cisa.gov | US Government Resource |
| www.sick.com/media/docs/9/19/719/special_information_sick_operating_guidel... | [email protected] | www.sick.com | Product |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
Additional Advisory Data
Workarounds
CNA: Please make sure that only trusted entities have access to the device. Furthermore, you should apply the following General Security Measures when operating the product to mitigate the associated security risk. The collected resources "SICK Operating Guidelines" and "ICS-CERT recommended practices on Industrial Security" could help to implement the general security practices.
There are currently no legacy QID mappings associated with this CVE.