Vulnerability Description
JavaScript can be ran inside the address bar via the dashboard "Open in new Tab" Button, making the application vulnerable to session hijacking.
CVSS Score
4.5
MEDIUM
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Sick | Baggage Analytics | All versions |
| Sick | Logistic Diagnostic Analytics | All versions |
| Sick | Package Analytics | All versions |
| Sick | Tire Analytics | All versions |
Related Weaknesses (CWE)
References
- https://sick.com/psirtVendor Advisory
- https://www.cisa.gov/resources-tools/resources/ics-recommended-practicesUS Government Resource
- https://www.first.org/cvss/calculator/3.1Not Applicable
- https://www.sick.com/.well-known/csaf/white/2025/sca-2025-0010.jsonVendor Advisory
- https://www.sick.com/.well-known/csaf/white/2025/sca-2025-0010.pdfVendor Advisory
- https://www.sick.com/media/docs/9/19/719/special_information_sick_operating_guidProduct
FAQ
What is CVE-2025-9913?
CVE-2025-9913 is a vulnerability with a CVSS score of 4.5 (MEDIUM). JavaScript can be ran inside the address bar via the dashboard "Open in new Tab" Button, making the application vulnerable to session hijacking.
How severe is CVE-2025-9913?
CVE-2025-9913 has been rated MEDIUM with a CVSS base score of 4.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2025-9913?
Check the references section above for vendor advisories and patch information. Affected products include: Sick Baggage Analytics, Sick Logistic Diagnostic Analytics, Sick Package Analytics, Sick Tire Analytics.