CVE-2025-49187
BaseFortify
Publication date: 2025-06-12
Last updated on: 2026-01-29
Assigner: SICK AG
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| sick | field_analytics | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-204 | The product provides different responses to incoming requests in a way that reveals internal state information to an unauthorized actor outside of the intended control sphere. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability occurs because the application returns different error messages for failed login attempts depending on whether the failure was due to an incorrect password or a non-existing username. This behavior allows an attacker to determine which usernames exist in the system by trying different usernames and observing the error messages.
How can this vulnerability impact me? :
The vulnerability can impact you by allowing attackers to enumerate valid usernames in your system. This information can be used to facilitate further attacks, such as targeted password guessing or social engineering, potentially leading to unauthorized access.