CVE-2025-49191 | BDVDB-2026-282349 Detail
SICKSICK Field Analytics
Description#
Linked URLs during the creation of iFrame widgets and dashboards are vulnerable to code execution. The URLs get embedded as iFrame widgets, making it possible to attack other users that access the dashboard by including malicious code. The attack is only possible if the attacker is authorized to create new dashboards or iFrame widgets.
Impact#
Per CVSS v3.1: confidentiality impact low, integrity impact low, availability impact none. Attack vector: network.
Weaknesses#
- CWE-1021 Improper Restriction of Rendered UI Layers or Frames
References#
- https://sick.com/psirt
- https://cdn.sick.com/media/docs/1/11/411/Special_information_CYBERSECURITY_BY_SICK_en_IM0084411.PDF
- https://www.cisa.gov/resources-tools/resources/ics-recommended-practices
- https://www.first.org/cvss/calculator/3.1
- https://www.sick.com/.well-known/csaf/white/2025/sca-2025-0007.pdf
- https://www.sick.com/.well-known/csaf/white/2025/sca-2025-0007.json
Exploit#
No public exploit known
History#
- Version 1Record published in the CVE List.