CVE-2025-49196 is a medium severity flaw (CVSS 6.5) in SICK Field Analytics. A service supports a deprecated and unsafe TLS version, which could expose sensitive data or allow tampering. SICK lists no fixed version and advises limiting access to trusted entities.
What's affected
SICK's advisory SCA-2025-0007 lists SICK Field Analytics, all versions, as affected. The advisory gives no fixed release for this CVE. Its recommendation is to make sure that only trusted entities have access to the device and to apply SICK's general security measures. The advisory points to the SICK Operating Guidelines and the ICS-CERT recommended practices on industrial security.
The record does not say which TLS version is involved or which service exposes it. Ask SICK support for those details if you need to document it for an audit.
How to check if you're exposed
Find where Field Analytics runs, and find the services that listen for encrypted connections. You can test which TLS versions a service accepts with openssl. Replace the host and port with your own.
openssl s_client -connect field-analytics.example.internal:443 -tls1 </dev/null
openssl s_client -connect field-analytics.example.internal:443 -tls1_1 </dev/null
If a handshake completes on one of the old protocol versions, the service accepts it. Many current openssl builds disable those versions on the client side, so a failure may mean your client refused rather than the server. A scanner built for TLS configuration gives a clearer answer.
Also look at the network path. The CVSS vector in the record lists a network attack vector and high attack complexity, because a successful attack needs a position on the network path. That makes network segmentation your main protection.
What to do now
- List every Field Analytics instance and where it sits on the network.
- Restrict access to trusted hosts, and keep it off the internet.
- Put the device behind a gateway or proxy that enforces modern TLS if your architecture allows it.
- Ask SICK support about a configuration option or update that turns off the old protocol version.
- Track the SICK PSIRT page for updates to this advisory.
Why it matters
The record files this as CWE-327, use of a broken or risky cryptographic algorithm. Old TLS versions have known design weaknesses. A server that still accepts them lets an attacker on the path push the connection toward the weaker option, and then read or alter traffic that was meant to be private.
The score is moderate because the attack needs a position between client and server. For devices in industrial networks, which rarely get replaced quickly, the practical answer is to shrink the number of hosts that can reach them. This CVE is not on the CISA Known Exploited Vulnerabilities list, and the advisory says SICK knows of no public exploits.
Quick check
Is there a patch?
The advisory lists none for this CVE. It recommends restricting access and following general security measures.
Why is attack complexity high?
The vector marks it high because the attacker must be able to observe or alter traffic between the client and the device.
Sources
Last reviewed: 18 October 2026.
