CVE-2025-59461 is a high severity (CVSS 7.6) missing authorization flaw in the SICK TLOC100-100 localisation system. Its C++ API does not require authentication. SICK's advisory gives mitigations, not a firmware fix, so limit network access to trusted entities. The sections below cover who is affected, how to check, and what to do now.
What's affected
The record names the SICK TLOC100-100 and its firmware. SICK's advisory SCA-2025-0013 lists this as one of several issues in the product and, for this one, gives a mitigation rather than a vendor fix. The same advisory recommends firmware 7.1.1 or later for a different issue, CVE-2025-59459, which is not the same as a fix for this one.
Because the advisory does not name a fixed version for CVE-2025-59461, check the SICK PSIRT page for updates.
How to check if you're exposed
Find the devices on your network. They are industrial units, so start from your OT asset list, then confirm the firmware version in the device's own interface and compare with the SICK advisory.
Then check who can reach the device's API. The CVSS vector in the record is adjacent network, not remote internet, which means attackers on the same network segment are the concern. Review the firewall rules and the segment the device sits in.
What to do now
- Identify all TLOC100-100 units and their firmware versions.
- Make sure only trusted entities can reach the device, as the advisory instructs.
- Place the devices in a segmented network with firewall rules limiting the API to known clients.
- Apply the SICK general security measures and the ICS-CERT recommended practices linked from the advisory.
- Watch the SICK PSIRT page for a firmware release that addresses this issue.
Why it matters
The record maps this to CWE-862, missing authorization. The advisory summary says a remote unauthenticated attacker may use the unauthenticated C++ API to access or modify sensitive data and disrupt services.
One discrepancy is worth flagging. The description says remote, but the vector in the record uses AV:A, adjacent network, and SICK's own scoring is the same. So the practical exposure is to attackers who already share the network segment. SICK also states that it is not aware of public exploits, and the CVE is not on the CISA KEV list.
Missing authentication is the simplest class of access flaw to describe and one of the easiest to prevent. A function that changes data or reveals data must check who is asking, every time, on the server. Hiding the URL, or relying on the front end to show a login screen first, does not count as a check.
A useful habit is to list every route, endpoint and file an application exposes and mark which ones enforce a login. Anything unmarked is a finding until proven otherwise. Network controls such as an allow list or a VPN reduce who can reach the service, but they are a layer on top of authentication, not a substitute for it.
A word on the advisory itself: its second revision removed a CVE identifier from a different entry, so if you are reconciling advisory text against a vulnerability scanner, expect small differences. The mitigation guidance for CVE-2025-59461 is the same in both.
A dependency scan will not see this one, because it concerns a product or service rather than a package in your code. The practical step is an asset inventory that records which of these products you run, which version, and who owns it. You can look up the record for this CVE in the Safeguard Gold directory and use the free scan at gold.safeguard.sh/scan for the software you build yourself.
Quick check
Is there a firmware fix for CVE-2025-59461?
The SICK advisory gives mitigations only for this issue. A firmware 7.1.1 or later recommendation applies to a different CVE in the same advisory.
Is the attack remote over the internet?
The vector says adjacent network. Treat the segment the device is on as the boundary to protect.
Sources
- SICK advisory SCA-2025-0013 (CSAF)
- SICK PSIRT
- NVD record data
Last reviewed: 18 October 2026.
