{"id":"CVE-2025-49181","aliases":["EUVD-2025-18173","GHSA-hg56-h8gv-pp6x"],"status":"published","title":"Configurations endpoint does not require authorization","description":"Due to missing authorization of an API endpoint, unauthorized users can send HTTP GET\nrequests to gather sensitive information. An attacker could also send HTTP POST requests to modify\nthe log files’ root path as well as the TCP ports the service is running on, leading to a Denial of Service\nattack.","severity":{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.0042,"percentile":0.3663,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-862"],"published":"2025-06-12T13:14:07Z","modified":"2026-06-17T09:30:53Z","products":[{"vendor":"sick","product":"media_server"},{"vendor":"sick ag","product":"sick media server"}],"references":[{"url":"https://sick.com/psirt","tags":["x_SICK PSIRT Website","Vendor Advisory"]},{"url":"https://cdn.sick.com/media/docs/1/11/411/Special_information_CYBERSECURITY_BY_SICK_en_IM0084411.PDF","tags":["x_SICK Operating Guidelines","Broken Link"]},{"url":"https://www.cisa.gov/resources-tools/resources/ics-recommended-practices","tags":["x_ICS-CERT recommended practices on Industrial Security","US Government Resource"]},{"url":"https://www.first.org/cvss/calculator/3.1","tags":["x_CVSS v3.1 Calculator","Not Applicable"]},{"url":"https://www.sick.com/.well-known/csaf/white/2025/sca-2025-0007.pdf","tags":["vendor-advisory","Vendor Advisory"]},{"url":"https://www.sick.com/.well-known/csaf/white/2025/sca-2025-0007.json","tags":["vendor-advisory","x_csaf","Vendor Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-49181"},{"url":"https://github.com/advisories/GHSA-hg56-h8gv-pp6x"}],"sources":{"cve":[{"id":"CVE-2025-49181","title":"Configurations endpoint does not require authorization","description":"Due to missing authorization of an API endpoint, unauthorized users can send HTTP GET\nrequests to gather sensitive information. An attacker could also send HTTP POST requests to modify\nthe log files’ root path as well as the TCP ports the service is running on, leading to a Denial of Service\nattack.","status":"published","published":"2025-06-12T13:14:07.75Z","modified":"2025-06-12T13:26:27.281Z","cvss":[{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T14:32:24.825718Z"}],"euvd":[{"id":"EUVD-2025-18173","description":"Due to missing authorization of an API endpoint, unauthorized users can send HTTP GET\nrequests to gather sensitive information. An attacker could also send HTTP POST requests to modify\nthe log files’ root path as well as the TCP ports the service is running on, leading to a Denial of Service\nattack.","status":"published","published":"2025-06-12T13:14:07Z","modified":"2025-06-12T13:26:27Z","cvss":[{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H","level":"high"}],"updated_at":"2026-11-02T20:32:24.598995Z"}],"ghsa":[{"id":"GHSA-hg56-h8gv-pp6x","title":"Due to missing authorization of an API endpoint, unauthorized users can send HTTP GET\nrequests to...","description":"Due to missing authorization of an API endpoint, unauthorized users can send HTTP GET\nrequests to gather sensitive information. An attacker could also send HTTP POST requests to modify\nthe log files’ root path as well as the TCP ports the service is running on, leading to a Denial of Service\nattack.","status":"published","published":"2025-06-12T15:31:22Z","modified":"2025-06-12T15:31:29Z","cvss":[{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H","level":"high"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T15:02:42.160981Z"}],"nvd":[{"id":"CVE-2025-49181","description":"Due to missing authorization of an API endpoint, unauthorized users can send HTTP GET\nrequests to gather sensitive information. An attacker could also send HTTP POST requests to modify\nthe log files’ root path as well as the TCP ports the service is running on, leading to a Denial of Service\nattack.","status":"published","published":"2025-06-12T14:15:30.27Z","modified":"2026-06-17T09:30:53.24Z","cvss":[{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H","level":"high","assessor":"secondary"},{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T14:11:11.789448Z"}]}}