CVE-2025-49195 is a medium severity flaw (CVSS 5.3) in SICK Media Server. The FTP server does not limit login attempts, so an attacker can guess passwords. SICK lists no fixed version for this one and recommends strong passwords and restricted access.
What's affected
SICK's advisory SCA-2025-0007 lists SICK Media Server, all versions, as affected by this issue. Other issues in the same advisory have a fix in Media Server 1.5, but this CVE has none listed. Do not assume that upgrading to 1.5 closes it.
The vendor's mitigation is a strong password of at least eight characters that mixes letters, numbers, capital letters and symbols, together with access only for trusted entities. The advisory also points to SICK's general security measures and the ICS-CERT recommended practices for industrial security.
How to check if you're exposed
Find out whether the FTP service of the Media Server is enabled and who can reach it. From a host on the same network you can check whether the standard port answers:
nc -vz media-server.example.internal 21
Replace the host name with yours. If the port is open to networks beyond the ones that need it, narrow it. Next, review the accounts on the FTP service, and check whether any use short or default passwords.
The CVSS vector in the record lists a network attack vector and no privileges required, with a low confidentiality impact. Look at your FTP logs for long runs of failed logins from one address, which is the usual sign of guessing.
What to do now
- Inventory every Media Server and check whether its FTP service is switched on.
- Disable the FTP service if you do not need it.
- Set strong, unique passwords on all FTP accounts, as SICK recommends.
- Restrict network access with firewall rules so that only trusted hosts reach the service.
- Add monitoring or an alert for repeated failed logins, since the product does not throttle them.
- Check the SICK advisory page for updates, since no fix is listed today.
Why it matters
The weakness is improper restriction of excessive authentication attempts, filed as CWE-307. Without a limit on attempts, a login form or service is only as strong as its passwords, because a program can try guesses at machine speed. Rate limiting, lockouts and delays are the usual defences, and when the product does not provide them you must supply controls around it.
Plain FTP also sends passwords without encryption, which is a separate reason to keep the service on a closed network. This CVE is not on the CISA Known Exploited Vulnerabilities list, and the advisory says SICK knows of no public exploits.
Quick check
Does Media Server 1.5 fix this?
The advisory lists no fixed version for this CVE. Other CVEs in the same advisory are fixed in 1.5, but this one relies on mitigations.
What is the quickest way to cut risk?
Turn off FTP if you do not need it, and limit access to trusted hosts if you do.
Sources
Last reviewed: 18 October 2026.
