CVE-2025-58578
Unlimited user creation by authorized users
CVE-2025-58578 is a low vulnerability (CVSS 3.8) in Sick Enterprise Analytics, published October 6, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.32%, the 25th percentile. No source names a fixed version.
- Severity
- 3.8 LowCVSS 3.1, CVE List
- Exploit chance
- 0.32%EPSS, 25th percentile
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
- No fix listedNo source names one
Description
A user with the appropriate authorization can create any number of user accounts via an API endpoint using a POST request. There are no quotas, checking mechanisms or restrictions to limit the creation.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- High
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- Low
- Availability
- Low
Exploit likelihood
Affected products
What each source reports
CVE List Score used
Unlimited user creation by authorized users
A user with the appropriate authorization can create any number of user accounts via an API endpoint using a POST request. There are no quotas, checking mechanisms or restrictions to limit the creation.
- Record
CVE-2025-58578- CVSS 3.1
- 3.8 Low
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:L - Weakness
- CWE-770
- Updated
- 2026-11-02
EUVDEUVD-2025-32204
A user with the appropriate authorization can create any number of user accounts via an API endpoint using a POST request. There are no quotas, checking mechanisms or restrictions to limit the creation.
- Record
EUVD-2025-32204- CVSS 3.1
- 3.8 Low
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:L - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-3h74-cgv6-v9hg
A user with the appropriate authorization can create any number of user accounts via an API ...
A user with the appropriate authorization can create any number of user accounts via an API endpoint using a POST request. There are no quotas, checking mechanisms or restrictions to limit the creation.
- Record
GHSA-3h74-cgv6-v9hg- CVSS 3.1
- 3.8 Low
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:L - Weakness
- CWE-770
- Updated
- 2026-11-02
NVD
A user with the appropriate authorization can create any number of user accounts via an API endpoint using a POST request. There are no quotas, checking mechanisms or restrictions to limit the creation.
- Record
CVE-2025-58578- CVSS 3.1
- 3.8 Low
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:L - CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N - Weakness
- CWE-770
- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
sick.com/psirt
sick.com/media/docs/9/19/719/special_information_sick_operating_guidelines_cybersecurity_by_sick_en_im0106719.pdf
cisa.gov/resources-tools/resources/ics-recommended-practices
first.org/cvss/calculator/3.1
nvd.nist.gov/vuln/detail/CVE-2025-58578
github.com/advisories/GHSA-3h74-cgv6-v9hg