CVE-2025-58580
⚪ Do wiadomości
Brak walidacji danych w API umożliwia atakującemu manipulację wpisami w logach.
CVSS
6.5
EPSS
0.4%
Exploit
none
Vendor
sick
Opis źródłowy (NVD)
An API endpoint allows arbitrary log entries to be created via POST request. Without sufficient validation of the input data, an attacker can create manipulated log entries and thus falsify or dilute logs, for example.
brak
Brak patcha
Źródła i daty
| Źródło | Wartość |
|---|---|
| NVD – CVSS | 6.5 |
| CISA KEV (aktywnie wykorzystywane) | Nie |
| FIRST EPSS (prawdopodobieństwo exploita) | 0.4% |
| Opublikowano (NVD) | 2025-10-06 07:15:34 UTC |
| Ostatnia modyfikacja (NVD) | 2026-10-09 10:10:00 UTC |
Referencje
- https://sick.com/psirt ([email protected]) [Vendor Advisory]
- https://www.cisa.gov/resources-tools/resources/ics-recommended-practices ([email protected]) [US Government Resource]
- https://www.first.org/cvss/calculator/3.1 ([email protected]) [Not Applicable]
- https://www.sick.com/.well-known/csaf/white/2025/sca-2025-0010.json ([email protected]) [Vendor Advisory]
- https://www.sick.com/.well-known/csaf/white/2025/sca-2025-0010.pdf ([email protected]) [Vendor Advisory]
- https://www.sick.com/media/docs/9/19/719/special_information_sick_operating_guidelines_cybersecurity_by_sick_en_im0106719.pdf ([email protected]) [Product]