CVE-2025-49182 is a high severity flaw (CVSS 7.5) in SICK Media Server. Files in the source code contain the admin login and the property configuration password, which can give an attacker full access to the application. SICK advises upgrading to version 1.5 or later and changing the default passwords.
What's affected
SICK's coordinated advisory (SCA-2025-0007) lists SICK Media Server versions up to and including 1.4 as affected, and version 1.5 as the fixed release. The same advisory covers several other issues in SICK Field Analytics and SICK Media Server, each with its own CVE.
The vendor's recommended action is to upgrade to the latest Media Server release, 1.5 or higher, and to change the default passwords. The advisory adds that SICK is not aware of any public exploits.
How to check if you're exposed
Find where Media Server runs. Check the product's version in its interface, or from the installed package details on the host.
Then check the credentials. Ask whether anyone has changed the administrator password and the property configuration password since installation. If the original values are still in use, treat them as known to others, because the record says they are stored in the source code.
Next, look at the network. The CVSS vector in the record lists a network attack vector, low complexity and no privileges required, with high impact on confidentiality. A Media Server instance that is reachable from outside the plant or office network is the first thing to fix. SICK's general guidance for these devices is to minimise network exposure and keep them in a protected IT environment.
What to do now
- List every SICK Media Server in your estate with its version.
- Upgrade to 1.5 or later, following SICK's instructions.
- Change the default administrator password and the property configuration password. Use strong, unique values.
- Restrict network access to trusted hosts only, and keep the service off the internet.
- Review access logs for logins you do not recognise from before the upgrade.
Why it matters
The record files this as CWE-540, inclusion of sensitive information in source code. Credentials embedded in code files are fixed for every installation that ships the same files, so anyone who can read those files, or knows what others have found in them, has a working login. Rotating a password after installation helps only if the old value is removed everywhere it was stored.
For industrial and sensor software, the risk is wider than the application, because these systems often sit beside equipment on a plant network. This CVE is not on the CISA Known Exploited Vulnerabilities list, and the advisory says SICK knows of no public exploits.
Quick check
Is changing the password enough?
SICK recommends both the upgrade to 1.5 or later and changing default passwords. Do both.
Does the same advisory cover other flaws?
Yes. It lists many CVEs for SICK Media Server and Field Analytics, so read the full advisory for your product.
Sources
Last reviewed: 18 October 2026.
