CVE-2025-49199 is a high severity flaw (CVSS 8.8) in SICK Field Analytics. Backup ZIP files are not signed, so an attacker can download one, change it and upload it again. SICK lists no fixed version and advises limiting access to trusted entities.
What's affected
SICK's advisory SCA-2025-0007 lists SICK Field Analytics, all versions, as affected. There is no fixed release in the advisory for this CVE. The vendor recommends that only trusted entities can reach the device, and points to its general security measures, the SICK Operating Guidelines and the ICS-CERT recommended practices for industrial security.
Per the record, a modified backup can configure services so they cannot run, which makes the application unusable, or redirect traffic meant for internal services to servers the attacker hosts, which allows information gathering.
How to check if you're exposed
Start by finding every Field Analytics device and asking who can sign in. The CVSS vector in the record lists a network attack vector, low complexity and low privileges required, so an account with limited rights is enough in the vector's terms. Review the list of users on each device and remove accounts that are no longer needed.
Next, find out where backups are created, downloaded and stored. Anyone who can read or replace a backup file can take advantage of the flaw. Check the permissions on the storage location and on any shared folders or transfer tools that handle backup files.
You can protect your own copies without waiting for the vendor. Record a checksum when you create a backup and verify it before restoring:
sha256sum field-analytics-backup.zip
Keep the checksum somewhere that attackers who can reach the device cannot also edit.
What to do now
- Inventory the Field Analytics devices and the accounts that can sign in to each.
- Restrict network access to trusted hosts only.
- Store backups in a protected location and record a checksum for each one at creation time.
- Verify the checksum before you restore any backup, and never restore a file of unknown origin.
- Review the device's service configuration for entries that point internal traffic to unfamiliar hosts.
- Watch the SICK PSIRT page for a fixed release.
Why it matters
The record files this under CWE-345, insufficient verification of data authenticity. If a system restores a file without proving who created it, the file becomes an input that anyone with access can control, and a configuration backup controls a great deal. A digital signature or message authentication code ties the file to the application that produced it.
The high score reflects the effect on all three of confidentiality, integrity and availability in the vector. This CVE is not on the CISA Known Exploited Vulnerabilities list, and the advisory says SICK knows of no public exploits.
Quick check
Is there a fixed release?
None is listed in the advisory for this CVE. The vendor recommends restricting access to trusted entities.
Can I protect backups myself?
A checksum stored outside the device helps you detect changes before restoring. It does not replace a signature built into the product.
Sources
Last reviewed: 18 October 2026.
