CVE-2025-58587 is a medium severity (CVSS 6.5) weakness in SICK analytics products. The application does not limit repeated failed logins, so an attacker can guess credentials. Per SICK advisory SCA-2025-0010, the affected products below version 4.6.3 are fixed in 4.6.3. Restrict network access as well.
What's affected
Per the SICK CSAF advisory SCA-2025-0010, Baggage Analytics, Tire Analytics and the other listed analytics products below version 4.6.3 are known affected for this CVE. The recommended fix is version 4.6.3.
The record lists these products: Baggage Analytics, Enterprise Analytics, Logistic Diagnostic Analytics, Package Analytics and Tire Analytics.
For Enterprise Analytics the advisory gives a workaround rather than a fixed version: make sure only trusted entities have access, and apply SICK's general security measures. Read the advisory for your exact product.
SICK states in the advisory that it was not aware of public exploits when it published.
How to check if you're exposed
Identify which of the listed analytics products you run and which version. The product's about page or your deployment records show this.
Then read SICK advisory SCA-2025-0010, available as a CSAF file and a PDF through the SICK PSIRT pages, and compare its affected version list with yours.
curl -s https://www.sick.com/.well-known/csaf/white/2025/sca-2025-0010.json | python3 -m json.tool | less
Finally check where the application is reachable. These tools belong on an operations network, not on the open internet. Review authentication logs for runs of failed logins.
What to do now
- List the SICK analytics products and versions in your environment.
- Update affected products below 4.6.3 to version 4.6.3, as SICK recommends.
- For Enterprise Analytics, follow the advisory workaround and keep access limited to trusted entities.
- Keep the applications on a segmented operations network, reachable only through a VPN or an allow list.
- Use strong, unique passwords, and alert on bursts of failed logins.
- Review your logs for requests to the affected area from accounts or addresses that do not normally use it.
- Test with a low privilege account after patching to confirm the restriction now holds.
Why it matters
The record describes missing limits on failed authentication attempts. Without rate limiting, lockout or delay, an attacker can try passwords as fast as the network allows. The CVE is classed as CWE-307, improper restriction of excessive authentication attempts.
The CVSS vector shows no privileges needed, low impact on integrity and availability and none on confidentiality, which is why the score is medium. In industrial and logistics settings, a guessed account on an analytics system is still a foothold, so network segmentation matters as much as the vendor fix.
The record classifies the weakness as CWE-307 (Improper Restriction of Excessive Authentication Attempts).
Access control bugs are quiet. Nothing crashes and no error appears, because the application does exactly what the request asked. The flaw is that the server never asked whether the caller was allowed to ask.
The durable fix is to check authorization on the server for every action, tied to the identity of the caller, and never to rely on what the browser interface chooses to show. Reviewing a few sensitive endpoints with a second account of lower privilege is a cheap way to find this class of problem before someone else does.
The record shows this CVE is not in the CISA Known Exploited Vulnerabilities catalog.
Quick check
Which version fixes CVE-2025-58587?
Per SICK advisory SCA-2025-0010, version 4.6.3 is the recommended fix for the affected products listed with versions below 4.6.3.
What helps if I cannot update yet?
Keep the application off untrusted networks, use strong unique passwords, and alert on repeated failed logins. For Enterprise Analytics, SICK gives this kind of workaround in the advisory.
Sources
- SICK PSIRT
- SICK advisory SCA-2025-0010 (CSAF)
- SICK advisory SCA-2025-0010 (PDF)
- CISA ICS recommended practices
Last reviewed: 18 October 2026.
