{"id":"CVE-2025-49183","aliases":["EUVD-2025-18186","GHSA-rpp7-mxqc-mp33"],"status":"published","title":"Unencrypted communication (HTTP)","description":"All communication with the REST API is unencrypted (HTTP), allowing an attacker to intercept traffic between an actor and the webserver. This leads to the possibility of information gathering and downloading media files.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00323,"percentile":0.25552,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-319"],"published":"2025-06-12T13:21:57Z","modified":"2026-06-17T09:30:53Z","products":[{"vendor":"sick","product":"media_server"},{"vendor":"sick ag","product":"sick media server"}],"references":[{"url":"https://sick.com/psirt","tags":["x_SICK PSIRT Website","Vendor Advisory"]},{"url":"https://cdn.sick.com/media/docs/1/11/411/Special_information_CYBERSECURITY_BY_SICK_en_IM0084411.PDF","tags":["x_SICK Operating Guidelines","Broken Link"]},{"url":"https://www.cisa.gov/resources-tools/resources/ics-recommended-practices","tags":["x_ICS-CERT recommended practices on Industrial Security","US Government Resource"]},{"url":"https://www.first.org/cvss/calculator/3.1","tags":["x_CVSS v3.1 Calculator","Not Applicable"]},{"url":"https://www.sick.com/.well-known/csaf/white/2025/sca-2025-0007.pdf","tags":["vendor-advisory","Vendor Advisory"]},{"url":"https://www.sick.com/.well-known/csaf/white/2025/sca-2025-0007.json","tags":["vendor-advisory","x_csaf","Vendor Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-49183"},{"url":"https://github.com/advisories/GHSA-rpp7-mxqc-mp33"}],"sources":{"cve":[{"id":"CVE-2025-49183","title":"Unencrypted communication (HTTP)","description":"All communication with the REST API is unencrypted (HTTP), allowing an attacker to intercept traffic between an actor and the webserver. This leads to the possibility of information gathering and downloading media files.","status":"published","published":"2025-06-12T13:21:57.463Z","modified":"2025-06-13T08:18:11.333Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"cna"}],"cwes":["CWE-319"],"updated_at":"2026-11-02T14:32:25.186422Z"}],"euvd":[{"id":"EUVD-2025-18186","description":"All communication with the REST API is unencrypted (HTTP), allowing an attacker to intercept traffic between an actor and the webserver. This leads to the possibility of information gathering and downloading media files.","status":"published","published":"2025-06-12T13:21:57Z","modified":"2025-06-13T08:18:11Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T20:32:24.065864Z"}],"ghsa":[{"id":"GHSA-rpp7-mxqc-mp33","title":"All communication with the REST API is unencrypted (HTTP), allowing an attacker to intercept...","description":"All communication with the REST API is unencrypted (HTTP), allowing an attacker to intercept traffic between an actor and the webserver. This leads to the possibility of information gathering and downloading media files.","status":"published","published":"2025-06-12T15:31:22Z","modified":"2025-06-12T15:31:29Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-319"],"updated_at":"2026-11-02T15:02:42.160981Z"}],"nvd":[{"id":"CVE-2025-49183","description":"All communication with the REST API is unencrypted (HTTP), allowing an attacker to intercept traffic between an actor and the webserver. This leads to the possibility of information gathering and downloading media files.","status":"published","published":"2025-06-12T14:15:30.58Z","modified":"2026-06-17T09:30:53.477Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"secondary"}],"cwes":["CWE-319"],"updated_at":"2026-11-02T14:11:11.789448Z"}]}}